目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1325 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
XSS and HTML Injection on the pressable.com search box
Automattic Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2022-08-23
Stored XSS on TikTok Ads
TikTok Cross-site Scripting (XSS) - DOM (CWE-79)
Medium
2022-08-19
Delimiter injection in GitHub Actions core.exportVariable
GitHub Misconfiguration (CWE-16)CVE-2022-35954
Medium
2022-08-18
Disabling context isolation, nodeIntegrationInSubFrames using an unauthorised frame.
Internet Bug Bounty Improper Access Control - Generic (CWE-284)
Medium
2022-08-11
Admin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.php
Shopify Improper Access Control - Generic (CWE-284)
Medium
2022-08-11
Wordpress Users Disclosure (/wp-json/wp/v2/users/)
Top Echelon Software Information Disclosure (CWE-200)
Medium
2022-08-11
many commands can be manipulated to delete identities or affiliations
Linux Foundation Decentralized Trust Improper Authentication - Generic (CWE-287)
Medium
2022-08-10
Read-only administrator can change agent update settings
Acronis Improper Access Control - Generic (CWE-284)
Medium
2022-08-10
xmlrpc.php FILE IS enable it will used for Bruteforce attack and Denial of Service(DoS)
Top Echelon Software Uncontrolled Resource Consumption (CWE-400)
Medium
2022-08-08
Anonymous access control - Payments Status
Omise Improper Access Control - Generic (CWE-284)
Medium
2022-08-07
RCE vulnerability in Hyperledger Fabric SDK for Java
Linux Foundation Decentralized Trust Deserialization of Untrusted Data (CWE-502)
Medium
2022-08-06
Enrolling to a CA that returns an empty response crashes the node process
Linux Foundation Decentralized Trust Uncontrolled Resource Consumption (CWE-400)
Medium
2022-08-06
Unauthenticated Private Messages DIsclosure via wordpress Rest API
Automattic Information Disclosure (CWE-200)
Medium
2022-08-04
XSS in redditmedia.com can compromise data of reddit.com
Reddit Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2022-08-03
Found Origin IP's lead to access to gitlab
GitLab Improper Access Control - Generic (CWE-284)
Medium
2022-08-02
HTML Injection via TikTok Ads Email Share
TikTok Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
Medium
2022-07-28
Off-by-slash vulnerability in nodejs.org and iojs.org
Internet Bug Bounty Path Traversal (CWE-22)
Medium
2022-07-28
reflected XSS on panther.com
Panther Labs Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)
Medium
2022-07-23
Rack CVE-2022-30122: Denial of Service Vulnerability in Rack Multipart Parsing
Internet Bug Bounty CVE-2022-30122
Medium
2022-07-23
CVE-2022-32214 - HTTP Request Smuggling Due To Improper Delimiting of Header Fields
Internet Bug Bounty HTTP Request Smuggling (CWE-444)CVE-2022-32214
Medium
2022-07-22
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—