目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,219
关联 CVE
1,854
参与项目数
342
近 7 天新增
10
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：elastic✕
blind Server-Side Request Forgery (SSRF) allows scanning internal ports
Elastic Server-Side Request Forgery (SSRF) (CWE-918)
Medium
2023-05-05
Synthetics Recorder: Code injection when recording website with malicious content
Elastic Code Injection (CWE-94)
High
2023-04-08
Default password on 34.120.209.175
Elastic Weak Cryptography for Passwords (CWE-261)
Medium
2022-11-18
CSRF in AppSearch allows creation of "curations"
Elastic Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2022-11-17
Fix for CVE-2021-22151 (Kibana path traversal issue) can be bypassed on Windows
Elastic Path Traversal (CWE-22)CVE-2021-22151
Low
2021-11-15
CVE-2021-40870 on [52.204.160.31]
Elastic Code Injection (CWE-94)CVE-2021-40870
Critical
2021-10-06
Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employee
Elastic Cleartext Storage of Sensitive Information (CWE-312)
Critical
2021-09-01
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)
Elastic Cross-site Scripting (XSS) - DOM (CWE-79)
High
2021-08-16
[Swiftype] - Stored XSS via document field `url` triggers on `https://app.swiftype.com/engines/<engine>/document_types/<type>/documents/<id>`
Elastic Cross-site Scripting (XSS) - Stored (CWE-79)
High
2021-08-03
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access
Elastic Improper Access Control - Generic (CWE-284)
High
2021-08-03
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges
Elastic Improper Access Control - Generic (CWE-284)
High
2021-06-02
RCE hazard in reporting (via Chromium)
Elastic Privilege Escalation (CAPEC-233)
Critical
2021-05-26
XXE in Enterprise Search's App Search web crawler
Elastic XML External Entities (XXE) (CWE-611)
Critical
2021-04-29
Remote Code Execution in coming Kibana 7.7.0
Elastic Privilege Escalation (CAPEC-233)
Critical
2021-04-19
Over-Privileged API Credentials for Elastic Agent
Elastic Violation of Secure Design Principles (CWE-657)
Medium
2021-03-29
Async search stores authorization headers in clear text
Elastic Cleartext Storage of Sensitive Information (CWE-312)
Medium
2021-01-19
Create an account on auth-sandbox.elastic.co with email @elastic.co or any other @domain.com
Elastic Improper Access Control - Generic (CWE-284)
High
2020-12-28
Remote Code Execution on Cloud via latest Kibana 7.6.2
Elastic Privilege Escalation (CAPEC-233)
Critical
2020-07-28
Stored XSS in TSVB Visualizations Markdown Panel
Elastic Cross-site Scripting (XSS) - Stored (CWE-79)
High
2020-07-28
Stored XSS in Elastic App Search
Elastic Cross-site Scripting (XSS) - Stored (CWE-79)
High
2020-07-28
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895