Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports

12,219

CVE-linked

1,854

Programs

342

New This Week

Severity: All Critical High Medium Low

Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

Program filter: x✕

niche s3 buckets are readable/writeable/deleteable by authorized AWS users

X / xAI Improper Authentication - Generic (CWE-287)

Unknown

2017-04-02

Attacker can get vine repost user all informations even Ip address and location .

X / xAI Improper Authentication - Generic (CWE-287)

Unknown

2017-03-25

Remote Unrestricted file Creation/Deletion and Possible RCE.

X / xAI Code Injection (CWE-94)

Low

2017-02-26

Sub Domain Takeover at mk.prd.vine.co

X / xAI

Unknown

2017-02-13

Clickjacking Periscope.tv on Chrome

X / xAI UI Redressing (Clickjacking) (CAPEC-103)

Medium

2017-02-06

GNIP subdomain take over

X / xAI

High

2017-02-06

Stealing User emails by clickjacking cards.twitter.com/xxx/xxx

X / xAI UI Redressing (Clickjacking) (CAPEC-103)

Medium

2017-02-03

leaking Digits OAuth authorization to third party websites

X / xAI Information Disclosure (CWE-200)

Unknown

2017-01-24

Twitter for android is exposing user's location to any installed android app

X / xAI Information Disclosure (CWE-200)

Low

2017-01-13

Twitter iOS fails to validate server certificate and sends oauth token

X / xAI Cryptographic Issues - Generic (CWE-310)CVE-2016-10511

High

2016-12-23

Information Disclosure through .DS_Store in ██████████

X / xAI Information Disclosure (CWE-200)

Unknown

2016-12-12

Cross-site scripting (reflected)

X / xAI Cross-site Scripting (XSS) - Generic (CWE-79)

Medium

2016-12-09

XSS using javascript:alert(8007)

X / xAI Cross-site Scripting (XSS) - Generic (CWE-79)

Low

2016-11-28

View liked twits of private account via publish.twitter.com

X / xAI Information Disclosure (CWE-200)

Medium

2016-11-14

Full Path Disclosure at 27.prd.vine.co

X / xAI

Low

2016-10-21

List of a ton of internal twitter servers available on GitHub

X / xAI Information Disclosure (CWE-200)

Unknown

2016-10-17

reverb.twitter.com redirects to vulnerable reverb.guru

X / xAI

Unknown

2016-10-01

Html Injection and Possible XSS in sms-be-vip.twitter.com

X / xAI Cross-site Scripting (XSS) - Generic (CWE-79)

Unknown

2016-08-28

File Upload XSS in image uploading of App in mopub

X / xAI Cross-site Scripting (XSS) - Generic (CWE-79)

Unknown

2016-08-25

Add tweet to collection CSRF

X / xAI Cross-Site Request Forgery (CSRF) (CWE-352)

Unknown

2016-08-22

Top Weakness Types

Most Active Programs

Program	Reports	Max $
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	—
HackerOne	609	—
Nextcloud	582	—
Shopify	464	—
curl	439	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	$9,895

Goal Reached Thanks to every supporter — we hit 100%!

Bug Bounty Intelligence