漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,219

关联 CVE

1,854

参与项目数

342

近 7 天新增

14

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

项目筛选：nodejs-ecosystem✕

[typeorm] SQL Injection

Node.js third-party modules SQL Injection (CWE-89)

High

2019-04-02

[glance] Access unlisted internal files/folders revealing sensitive information

Node.js third-party modules Information Exposure Through Directory Listing (CWE-548)

High

2019-02-28

Reflected XSS in the npm module express-cart.

Node.js third-party modules Cross-site Scripting (XSS) - Reflected (CWE-79)

Medium

2019-02-15

[serve] Access unlisted internal files/folders revealing sensitive information

Node.js third-party modules Information Exposure Through Directory Listing (CWE-548)

Critical

2019-02-07

Prototype pollution attack (upmerge)

Node.js third-party modules

Medium

2019-02-04

[bower] Arbitrary File Write through improper validation of symlinks while package extraction

Node.js third-party modules Path Traversal (CWE-22)CVE-2019-5484

High

2019-01-26

Command Injection Vulnerability in kill-port Package

Node.js third-party modules Command Injection - Generic (CWE-77)CVE-2019-5414

High

2019-01-06

[buttle] Unsafe rendering of Markdown files

Node.js third-party modules Cross-site Scripting (XSS) - Generic (CWE-79)

Low

2019-01-06

[static-resource-server] Path Traversal allows to read content of arbitrary file on the server

Node.js third-party modules Information Exposure Through Directory Listing (CWE-548)CVE-2018-16493

High

2019-01-03

[http-live-simulator] Path traversal vulnerability

Node.js third-party modules Path Traversal (CWE-22)CVE-2018-16479

High

2018-12-28

Prototype pollution attack (lutils-merge)

Node.js third-party modules Uncontrolled Resource Consumption (CWE-400)

Medium

2018-12-17

Prototype pollution attack in node.extend

Node.js third-party modules Uncontrolled Resource Consumption (CWE-400)CVE-2018-16491

Medium

2018-11-30

Prototype Pollution Vulnerability in mpath Package

Node.js third-party modules CVE-2018-16490

High

2018-11-30

Prototype pollution attack in just-extend

Node.js third-party modules Uncontrolled Resource Consumption (CWE-400)CVE-2018-16489

Medium

2018-11-29

flatmap-stream malicious package (distributed via the popular events-stream)

Node.js third-party modules Embedded Malicious Code (CWE-506)

Critical

2018-11-26

List any file in the folder by using path traversal

Node.js third-party modules Path Traversal (CWE-22)CVE-2018-16478

Medium

2018-11-23

Prototype pollution attack (mergify)

Node.js third-party modules

Medium

2018-11-20

Prototype Pollution Vulnerability in cached-path-relative Package

Node.js third-party modules Uncontrolled Resource Consumption (CWE-400)CVE-2018-16472

High

2018-11-02

[tianma-static] Stored xss on filename

Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2018-16474

Medium

2018-11-02

[takeapeek] Path traversal allow to expose directory and files

Node.js third-party modules Path Traversal (CWE-22)CVE-2018-16473

High

2018-11-02

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	—
HackerOne	609	—
Nextcloud	582	—
Shopify	464	—
curl	439	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	$9,895