Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,250
CVE-linked
1,864
Programs
343
New This Week
8
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Nginx version disclosure via forbidden page
Yelp Information Disclosure (CWE-200)
Low
2017-11-21
Listing of Amazon S3 Bucket accessible to any amazon authenticated user (metrics.pscp.tv)
X / xAI Information Disclosure (CWE-200)
Unknown
2017-11-19
Pending member invitations are not revoked on program name change
HackerOne Information Disclosure (CWE-200)
None
2017-11-18
Private Program all members disclosed
HackerOne Information Disclosure (CWE-200)
Unknown
2017-11-16
Program profile metrics endpoint contains mean time to triage, even when turned off
HackerOne Information Disclosure (CWE-200)
Medium
2017-11-14
Exposes a series of other private credentials
Legal Robot Information Disclosure (CWE-200)
None
2017-11-13
Ngnix Server version disclosure 404 Page!
Yelp Information Disclosure (CWE-200)
Unknown
2017-11-09
Nginx server version disclosure on engineeringblog
Yelp Information Disclosure (CWE-200)
None
2017-11-09
Research papers on yelp are getting indexed by google bots.
Yelp Information Disclosure (CWE-200)
Unknown
2017-11-09
Internal Ports Scanning via Blind SSRF
Infogram Information Disclosure (CWE-200)
Unknown
2017-11-03
Private partial disclosure of h1 infrastructure
HackerOne Information Disclosure (CWE-200)
None
2017-11-03
View Any Program's Team Members through GET https://hackerone.com/invitations/
HackerOne Information Disclosure (CWE-200)
Medium
2017-11-01
Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page
HackerOne Information Disclosure (CWE-200)
None
2017-11-01
Using an outdated version of OpenSSH on db01.wakatime.com
WakaTime Information Disclosure (CWE-200)
Low
2017-10-29
User Enumeration
Infogram Information Disclosure (CWE-200)
Low
2017-10-27
Report Private Links Leaks to Google Analytics via Query String Param
HackerOne Information Disclosure (CWE-200)
Medium
2017-10-25
Linux TBB SFTP URI allows local IP disclosure
Tor Information Disclosure (CWE-200)
Critical
2017-10-25
Preferred language option fingerprinting issue in Tor Browser
Tor Information Disclosure (CWE-200)
Low
2017-10-24
Banner Grabbing - Apache Server Version Disclousure
ownCloud Information Disclosure (CWE-200)
Unknown
2017-10-22
Scrollbar Width permits detecting browser platform
Tor Information Disclosure (CWE-200)
Low
2017-10-20
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify464—
curl459—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—