Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,262
CVE-linked
1,866
Programs
343
New This Week
0
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Stored XSS agent_status
8x8 Cross-site Scripting (XSS) - Stored (CWE-79)
High
2020-06-09
Bypass Email activation on http://axa.dxi.eu
8x8 Improper Access Control - Generic (CWE-284)
High
2020-06-09
Sensitive data disclosure via exposed phpunit file
8x8 Information Disclosure (CWE-200)
High
2020-06-09
Open TURN relay abuse is possible due to lack of peer access control (Critical)
8x8 Server-Side Request Forgery (SSRF) (CWE-918)
High
2020-06-08
SSRF on project import via the remote_attachment_url on a Note
GitLab Server-Side Request Forgery (SSRF) (CWE-918)
High
2020-06-07
HTTP Request Smuggling
Brave Software HTTP Request Smuggling (CWE-444)
High
2020-06-04
Node.js: TLS session reuse can lead to hostname verification bypass
Node.js Man-in-the-Middle (CWE-300)CVE-2020-8172
High
2020-06-03
Code injection possible with malformed Nextcloud Talk chat commands
Nextcloud Code Injection (CWE-94)CVE-2020-8180
High
2020-06-02
Firmware download/install vulnerable to CSRF
Ubiquiti Inc. Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2020-8168
High
2020-05-29
Organization Takeover
Helium Improper Access Control - Generic (CWE-284)
High
2020-05-27
Unrestricted file upload leads to stored xss on https://████████/
U.S. Dept Of Defense Cross-site Scripting (XSS) - Stored (CWE-79)
High
2020-05-27
Remote Code Execution through DNN Cookie Deserialization
U.S. Dept Of Defense OS Command Injection (CWE-78)
High
2020-05-27
Untrusted strings that are cache fetched with raw option are automatically marshal loaded
Ruby on Rails Deserialization of Untrusted Data (CWE-502)CVE-2020-8165
High
2020-05-26
able to login into login.topechelon.com
Top Echelon Software Privilege Escalation (CAPEC-233)
High
2020-05-20
Request smuggling on admin-official.line.me could lead to account takeover
LY Corporation HTTP Request Smuggling (CWE-444)
High
2020-05-19
Invalid write (or double free) triggers curl command line tool crash
curl Double Free (CWE-415)
High
2020-05-18
Customer private program can disclose email any users through invited via username
HackerOne Information Disclosure (CWE-200)
High
2020-05-15
Full Account Take-Over of ████████ Members via IDOR
U.S. Dept Of Defense Insecure Direct Object Reference (IDOR) (CWE-639)
High
2020-05-14
Stored Xss Vulnerability on ████████
U.S. Dept Of Defense Cross-site Scripting (XSS) - Stored (CWE-79)
High
2020-05-14
Domian Takeover in [███████]
U.S. Dept Of Defense Phishing (CAPEC-98)
High
2020-05-14
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—