Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: nextcloud✕
Email Spoofing
Nextcloud Phishing (CAPEC-98)
Medium
2020-02-20
Share recipient can modify a share's expiration date
Nextcloud Improper Access Control - Generic (CWE-284)CVE-2020-8122
Medium
2020-01-31
Update App Store: Django account high jacking vulnerability
Nextcloud Improper Access Control - Generic (CWE-284)
Medium
2020-01-31
File-drop content is visible through the gallery app
Nextcloud CVE-2020-8119
Medium
2020-01-31
Persistent XSS on favorite via filename
Nextcloud Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2019-12-12
Server-Side request forgery in New-Subscription feature of the calendar app
Nextcloud Server-Side Request Forgery (SSRF) (CWE-918)CVE-2020-8118
Medium
2019-12-12
Nextcloud domain and name of every user leaked to lookup server
Nextcloud Privacy Violation (CWE-359)CVE-2019-15623
Medium
2019-11-26
XSS On Nextcloud Integrated with zimbra drive
Nextcloud Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2019-11-11
Missing DNSSEC
Nextcloud Man-in-the-Middle (CWE-300)
Medium
2019-08-29
Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color`
Nextcloud Cross-site Scripting (XSS) - Reflected (CWE-79)CVE-2020-8120
Medium
2019-08-29
Passcode Protection in Android Devices Can be Bypassed.
Nextcloud Violation of Secure Design Principles (CWE-657)
Medium
2019-08-27
Stored XSS/HTML injection in autocomplete suggestions for sharing
Nextcloud Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2019-06-27
Predictable Random Number Generator
Nextcloud Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)
Medium
2019-06-26
Retrieval and alteration of exposed media on Android Oreo
Nextcloud Information Disclosure (CWE-200)
Medium
2019-06-26
Vulnerable W3 Total Cache plugin version in use on nextcloud.com
Nextcloud Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2019-06-21
Talk / spreed: Disclosure of Room names and participants for password protected rooms
Nextcloud Information Disclosure (CWE-200)
Medium
2019-04-17
Github wikis are editable by anyone
Nextcloud Improper Access Control - Generic (CWE-284)
Medium
2018-12-07
Shared file link - password protection bypass under certain conditions
Nextcloud Information Disclosure (CWE-200)CVE-2018-16467CVE-2019-5449
Medium
2018-09-25
Access control issue -- [Allow file system access not validated when using session auth]
Nextcloud Improper Access Control - Generic (CWE-284)CVE-2018-16466
Medium
2018-09-25
OAuth2 Access Token and App Password Security Vulnerability
Nextcloud Use of a Key Past its Expiration Date (CWE-324)CVE-2018-3761
Medium
2018-07-21
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895