Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
14
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: gitlab✕
Removing a user from a private group doesn't remove him from group's project, if his project's role was changed
GitLab Improper Access Control - Generic (CWE-284)
Medium
2019-04-05
Unauthorized users may be able to view almost all informations related to Private projects.
GitLab Information Disclosure (CWE-200)
Medium
2018-12-03
Persistent XSS - Deleting a project (No Longer Vulnerable in 10.7)
GitLab Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2018-09-20
Potensial SSRF via Git repository URL
GitLab Server-Side Request Forgery (SSRF) (CWE-918)
Medium
2018-07-16
Persistent XSS - Selecting users as allowed merge request approvers
GitLab Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2018-10379
Medium
2018-07-16
SSRF vulnerability in gitlab.com webhook
GitLab Server-Side Request Forgery (SSRF) (CWE-918)
Medium
2018-04-30
Cookie bomb
GitLab Uncontrolled Resource Consumption (CWE-400)
Medium
2018-02-16
Lack of validation before assigning custom domain names leading to abuse of GitLab pages service
GitLab Phishing (CAPEC-98)
Medium
2018-02-01
SSRF via git Repo by URL Abuse
GitLab Server-Side Request Forgery (SSRF) (CWE-918)
Medium
2017-11-28
SSRF vulnerability in gitlab.com via project import.
GitLab Server-Side Request Forgery (SSRF) (CWE-918)
Medium
2017-11-09
[Markdown] Stored XSS via character encoding parser bypass
GitLab Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2017-10-18
CSRF-Token leak by request forgery
GitLab Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2017-10-09
CSV injection in gitlab.com via issues export feature.
GitLab Command Injection - Generic (CWE-77)
Medium
2017-07-21
Gitlab.com is vulnerable to reverse tabnabbing. (#2)
GitLab UI Redressing (Clickjacking) (CAPEC-103)
Medium
2017-05-09
Gitlab.com is vulnerable to reverse tabnabbing via AsciiDoc links. (#3)
GitLab UI Redressing (Clickjacking) (CAPEC-103)
Medium
2017-05-09
Unfiltered `class` attribute in markdown code
GitLab Cross-site Scripting (XSS) - DOM (CWE-79)
Medium
2017-04-13
Open redirect
GitLab Open Redirect (CWE-601)
Medium
2017-04-06
[Repository Import] Open Redirect via "continue[to]" parameter
GitLab Open Redirect (CWE-601)
Medium
2017-04-06
[Subgroups] Unprivileged User Can Disclose Private Group Names
GitLab Insecure Direct Object Reference (IDOR) (CWE-639)
Medium
2017-03-30
[reStructuredText] XSS in project README files
GitLab Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2017-02-15
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895