漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,253

关联 CVE

1,865

参与项目数

343

近 7 天新增

6

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

Persistent XSS - Selecting users as allowed merge request approvers

GitLab Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2018-10379

Medium

2018-07-16

[m-server] HTML Injection in filenames displayed as directory listing in the browser allows to embed iframe with malicious JavaScript code

Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2018-16484

Medium

2018-07-12

Stored Cross Site Scripting

Y Combinator Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-07-09

[buttle] HTML Injection in filename leads to XSS when directory listing is displayed in the browser

Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2019-5422

Medium

2018-07-04

[sexstatic] HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name

Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2018-3755

Medium

2018-05-29

Unfiltered input allows for XSS in "Playtime Item Grants" fields

Valve Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-05-24

Stored XXS @ https://steamcommunity.com/search/users/#text= via Profile Name

Valve Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-05-24

Airship: Persistent XSS via Comment

Paragon Initiative Enterprises Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-04-24

Blind XSS - Report review - Admin panel

Eternal Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-03-29

[uppy] Stored XSS due to crafted SVG file

Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-03-01

Persistent DOM-based XSS in https://help.twitter.com via localStorage

X / xAI Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-02-24

[gem server] Stored XSS via crafted JavaScript URL inclusion in Gemspec

RubyGems Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-02-22

Stored XSS in WordPress

WordPress Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-02-02

Stored XSS on urbandictionary.com

Urban Dictionary Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2018-01-11

Stored XSS via Send crew invite

Rockstar Games Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-12-28

Lack of Sanitization and Insufficient Authentication

WordPress Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-12-26

Non Critical Code Quality Bug / Self XSS on Map Editor

Infogram Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-12-12

Stored Cross-Site scripting in the infographics using Data Objects links

Infogram Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-12-04

Stored Cross-Site scripting in the infographics using links

Infogram Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-12-04

[public-api.wordpress.com] Stored XSS via Crafted Developer App Description

Automattic Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-12-01

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	$2,257
HackerOne	609	—
Nextcloud	584	—
Shopify	464	—
curl	459	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$7,000
Uber	239	—