目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1000 CNY

100.0%
コーヒーを一杯おごる

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,219
关联 CVE
1,854
参与项目数
342
近 7 天新增
14
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：gitlab✕
Maintainer can leak sentry token by changing the configured URL (fix bypass)
GitLab Information Disclosure (CWE-200)
Medium
2024-10-08
Information Disclosure - Pvt Gitlab Issue Disclosing Through GitLab Unfiltered YouTube channel.
GitLab Information Disclosure (CWE-200)
Low
2023-09-13
Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net
GitLab Information Disclosure (CWE-200)
Low
2022-11-04
Use of Ruby Forwardable module and runtime meta-programming may introduce vulnerabilities
GitLab Information Disclosure (CWE-200)
Medium
2021-11-15
[information disclosure] Validate existence of a private project.
GitLab Information Disclosure (CWE-200)
Low
2021-03-09
Able to leak private email of any user given his/her username via graphql
GitLab Information Disclosure (CWE-200)
Medium
2021-01-08
Unauthorized user is able to access schedule pipeline variables and values
GitLab Information Disclosure (CWE-200)CVE-2020-13351
High
2020-11-30
Unauthorized access to private project security dashboard
GitLab Information Disclosure (CWE-200)
Medium
2020-11-21
Todos are not redacted when membership changes - Access to (confidential) issues and merge requests
GitLab Information Disclosure (CWE-200)
Medium
2020-11-02
EXIF metadata not stripped from JPG group logos
GitLab Information Disclosure (CWE-200)
Low
2020-09-08
gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read
GitLab Information Disclosure (CWE-200)
Critical
2020-06-08
Private System Note Disclosure using GraphQL
GitLab Information Disclosure (CWE-200)CVE-2019-15576
Low
2019-12-13
Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settings
GitLab Information Disclosure (CWE-200)CVE-2019-15577
Low
2019-12-13
Know whether private project name exists or not within a group using link comments
GitLab Information Disclosure (CWE-200)
Low
2019-10-07
Last build status and coverage leaked to unauthorized users
GitLab Information Disclosure (CWE-200)CVE-2019-5463
Low
2019-09-01
JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions
GitLab Information Disclosure (CWE-200)
Critical
2019-04-20
Snippet JS template allows attacker to read a user's private snippets
GitLab Information Disclosure (CWE-200)
Low
2019-03-03
Guests Will Disclose the Private Project Full Activity Via Project Activity Feeds
GitLab Information Disclosure (CWE-200)
None
2019-02-08
Unauthorized users may be able to view almost all informations related to Private projects.
GitLab Information Disclosure (CWE-200)
Medium
2018-12-03
SSRF when importing a project from a git repo by URL
GitLab Information Disclosure (CWE-200)
Unknown
2018-05-29
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895