漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,219

关联 CVE

1,854

参与项目数

342

近 7 天新增

10

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

项目筛选：gratipay✕

CSV injection in gratipay.com via payment history export feature.

Gratipay Command Injection - Generic (CWE-77)

Medium

2017-11-03

Saying goodbye to HackerOne and Gratipay.

Unknown

2017-11-02

Application-level DoS on image's "size" parameter.

Gratipay Uncontrolled Resource Consumption (CWE-400)

High

2017-11-02

Reflected SQL Execution

Unknown

2017-10-31

Gratipay Array Index Underflow (CWE-129)

Unknown

2017-10-31

Bypassing X-frame options

Gratipay UI Redressing (Clickjacking) (CAPEC-103)

None

2017-10-29

Sub Domain Takeover

None

2017-10-24

Broken link for stale DNS entry may be leveraged for Phishing, Misinformation, Serving Malware

None

2017-10-18

Adding Used Primary Email Address to attacker account and Account takeover

Gratipay Business Logic Errors (CWE-840)

None

2017-10-05

XSS found In Your Web

Gratipay Cross-site Scripting (XSS) - Generic (CWE-79)

None

2017-10-01

protect against tabnabbing in statement

Gratipay Improper Authentication - Generic (CWE-287)

Medium

2017-10-01

set Pragma header

Gratipay Improper Authentication - Generic (CWE-287)

Unknown

2017-09-09

Missing Certificate Authority Authorization rule

Unknown

2017-09-09

Missing Certificate Authority Authorization rule

Gratipay Cryptographic Issues - Generic (CWE-310)

Unknown

2017-09-09

Show hide privacy giving receiving on my website

Gratipay Privacy Violation (CWE-359)

Unknown

2017-09-09

400 Bad Request [Use a third-party provider to sign in or create an account on Gratipay]

Gratipay Violation of Secure Design Principles (CWE-657)

None

2017-09-09

clickjacking on https://gratipay.com/on/npm/[text]

Gratipay UI Redressing (Clickjacking) (CAPEC-103)

Unknown

2017-09-09

Reflected XSS - gratipay.com

Gratipay Cross-site Scripting (XSS) - Reflected (CWE-79)

Medium

2017-08-24

Gratipay rails secret token (secret_key_base) publicly exposed in GitHub

Gratipay Cleartext Storage of Sensitive Information (CWE-312)

Medium

2017-08-23

Gratipay Cross-Site Request Forgery (CSRF) (CWE-352)

Unknown

2017-08-21

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	—
HackerOne	609	—
Nextcloud	582	—
Shopify	464	—
curl	439	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	$9,895