目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,217
关联 CVE
1,854
参与项目数
342
近 7 天新增
12
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：uber✕
pam_ussh does not properly validate the SSH certificate authority
Uber Improper Authentication - Generic (CWE-287)
Medium
2021-07-21
Chained Bugs to Leak Victim's Uber's FB Oauth Token
Uber Improper Authentication - Generic (CWE-287)
High
2019-01-25
Open Redirect on central.uber.com allows for account takeover
Uber Improper Authentication - Generic (CWE-287)
High
2019-01-25
SMS URL verification link does not expire on phone number change and lacks rate limiting
Uber Improper Authentication - Generic (CWE-287)
Low
2018-12-19
Physical Access to Mobile App Allows Local Attribute Updates without Authentication
Uber Improper Authentication - Generic (CWE-287)
None
2018-12-19
SMS/Call spamming due to truncated phone number
Uber Improper Authentication - Generic (CWE-287)
Low
2018-11-13
No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts
Uber Improper Authentication - Generic (CWE-287)
Medium
2018-11-13
Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication
Uber Improper Authentication - Generic (CWE-287)CVE-2005-2169CVE-2005-0202
Medium
2017-12-26
It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without
Uber Improper Authentication - Generic (CWE-287)CVE-2005-2169CVE-2005-0202
Medium
2017-12-26
SAML Authentication Bypass on uchat.uberinternal.com
Uber Improper Authentication - Generic (CWE-287)
High
2017-09-05
Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com
Uber Improper Authentication - Generic (CWE-287)
Critical
2017-07-13
password reset token leaking allowed for ATO of an Uber account
Uber Improper Authentication - Generic (CWE-287)
Critical
2017-05-17
pam-ussh may be tricked into using another logged in user's ssh-agent
Uber Improper Authentication - Generic (CWE-287)
Medium
2017-03-20
Users can falsely declare their own Uber account info on the monthly billing application
Uber Improper Authentication - Generic (CWE-287)
Unknown
2016-10-20
Reading Emails in Uber Subdomains
Uber Improper Authentication - Generic (CWE-287)
Unknown
2016-09-14
Get organization info base on uuid
Uber Improper Authentication - Generic (CWE-287)
Unknown
2016-09-02
Wordpress Vulnerabilities in transparencyreport.uber.com and eng.uber.com domains
Uber Improper Authentication - Generic (CWE-287)
Unknown
2016-08-24
[IODR] Get business trip via organization id
Uber Improper Authentication - Generic (CWE-287)
Unknown
2016-08-15
[CRITICAL] -- Complete Account Takeover
Uber Improper Authentication - Generic (CWE-287)
Unknown
2016-08-15
Missing authentication on Notification setting .
Uber Improper Authentication - Generic (CWE-287)
Unknown
2016-07-26
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895