目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Denial of Service caused by HTTP/2 CONTINUATION Flood
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2024-24549
High
2024-04-22
Adobe Experience Manager 'Childlist selector' - Cross-Site Scripting on cbconnection-stage.adobe.com
Adobe Cross-site Scripting (XSS) - Reflected (CWE-79)
Low
2024-04-22
Cleartext Transmission of password via Email
Sheer Cleartext Transmission of Sensitive Information (CWE-319)
Low
2024-04-22
Docker Secret Disclosure via GitHub Actions Cache Poisoning
Linux Foundation Decentralized Trust Information Disclosure (CWE-200)
High
2024-04-20
Login page password-guessing attack
Revive Adserver Violation of Secure Design Principles (CWE-657)CVE-2016-9124
Unknown
2024-04-19
Stored XSS in messages
SideFX Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2024-04-17
Incorrect logic when buy one more license which may lead to extend the expire date of existing license
PortSwigger Web Security Business Logic Errors (CWE-840)
Unknown
2024-04-16
Self XSS in Tag name pattern field /<username>/<reponame>/settings/tag_protection/new
GitHub Cross-site Scripting (XSS) - Generic (CWE-79)CVE-2024-1084
Medium
2024-04-15
#1 XSS on watchdocs.indriverapp.com
inDrive Cross-site Scripting (XSS) - Reflected (CWE-79)
Low
2024-04-11
#2 XSS on watchdocs.indriverapp.com
inDrive Cross-site Scripting (XSS) - Reflected (CWE-79)
Medium
2024-04-11
#3 XSS on watchdocs.indriverapp.com
inDrive Cross-site Scripting (XSS) - Reflected (CWE-79)
Low
2024-04-11
Unprotected Atlantis Server at https://152.70.█.█
8x8 Improper Authentication - Generic (CWE-287)
Medium
2024-04-11
"Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
Node.js Uncontrolled Resource Consumption (CWE-400)CVE-2024-27983
High
2024-04-08
Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of Victim
Snapchat Privacy Violation (CWE-359)
Medium
2024-04-05
Reflected XSS on Pangle Endpoint
TikTok Cross-site Scripting (XSS) - Reflected (CWE-79)
High
2024-04-05
Race Condition Enables Bypassing Verification Check
Tools for Humanity Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
High
2024-04-04
[portswigger.net] Path Traversal al /cms/audioitems
PortSwigger Web Security Path Traversal (CWE-22)
High
2024-04-04
Using Branded Hashtag Feature User Partnered with Account Manager Can View Videos Uploaded By A Private TikTok Account If 'item_id' Is Known
TikTok Information Disclosure (CWE-200)
Medium
2024-04-03
CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc
Internet Bug Bounty CVE-2024-27281
High
2024-03-29
Libuv: Improper Domain Lookup that potentially leads to SSRF attacks
Internet Bug Bounty Server-Side Request Forgery (SSRF) (CWE-918)CVE-2024-24806
High
2024-03-29
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—