目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All Critical High Medium Low
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
CSRF leads to Account takeover
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2024-12-18
CSRF leads to Account takeover
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2024-12-18
CSRF Attack on changing security questions leads to full Account TakeOver
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2024-12-18
Argo CD CSRF leads to Kubernetes cluster compromise
Internet Bug Bounty Cross-Site Request Forgery (CSRF) (CWE-352)
High
2024-01-29
Cross-Site Request Forgery
ownCloud Cross-Site Request Forgery (CSRF) (CWE-352)
High
2023-11-05
Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone
HackerOne Cross-Site Request Forgery (CSRF) (CWE-352)
High
2023-06-19
CSRF to delete accounts [HtUS]
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2023-05-15
CSRF to ATO at https://█████/user/account [HtUS]
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2023-01-06
CSRF Account Takeover
TikTok Cross-Site Request Forgery (CSRF) (CWE-352)
High
2022-08-16
CSRF protection bypass in GitHub Enterprise management console
GitHub Cross-Site Request Forgery (CSRF) (CWE-352) CVE-2022-23732
High
2022-04-13
0-day Cross Origin Request Forgery vulnerability in Grafana 8.x .
Aiven Ltd Cross-Site Request Forgery (CSRF) (CWE-352) CVE-2022-21703
High
2022-03-16
Widespread CSRF on authenticated POST endpoints
UPchieve Cross-Site Request Forgery (CSRF) (CWE-352)
High
2022-02-13
CSRF in Account Deletion feature (https://www.flickr.com/account/delete)
Flickr Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-09-14
CSRF on /api/graphql allows executing mutations through GET requests
GitLab Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-08-02
Slack integration setup lacks CSRF protection
HackerOne Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-07-07
Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome
Starbucks Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-05-18
SocialClub Account Take Over Through Import Friends feature
Rockstar Games Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-04-01
[socket.io] Cross-Site Websocket Hijacking
Node.js third-party modules Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-01-31
███████mill is vulnerable to cross site request forgery that leads to full account take over.
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-01-25
[CSRF] TikTok Careers Portal Account Takeover
TikTok Cross-Site Request Forgery (CSRF) (CWE-352)
High
2020-12-15
高频漏洞类型
最活跃项目
项目 报告数 最高赏金
U.S. Dept Of Defense 896 —
Internet Bug Bounty 817 $2,257
HackerOne 609 —
Nextcloud 584 —
Shopify 465 —
curl 464 —
Node.js third-party modules 307 —
GitLab 258 —
X / xAI 250 —
Uber 239 —