目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,221
关联 CVE
1,854
参与项目数
342
近 7 天新增
7
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：deptofdefense✕
SQL Injection in Login Page: https://█████/█████████/login.php
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2020-05-14
Remote Code Execution - Unauthenticated Remote Command Injection (via Microsoft SharePoint CVE-2019-0604)
U.S. Dept Of Defense OS Command Injection (CWE-78)CVE-2019-0604
High
2020-05-11
Information disclousure by clicking on the link shown in http://████████/
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-12-02
Partial SSN exposed through Presentation slides on ██████████
U.S. Dept Of Defense Insecure Storage of Sensitive Information (CWE-922)
High
2019-10-10
MSSQL injection via param Customwho in https://█████/News/Transcripts/Search/Sort/ and WAF bypass
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2019-10-10
Information Disclosure (can access all ███s) within ███████ view █████████ Portal
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-08
SQL injection on █████ due to tech.cfm
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2019-10-08
Blind SQL injection on ████████
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2019-10-08
Publicly accessible Order confirmations leaking User Emails on ███
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-08
Code reversion allowing SQLI again in ███████
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2019-10-08
PII leakage due to caching of Order/Contract ID's on █████████
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-08
sql injection on /messagecenter/messagingcenter at https://www.███████/
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2019-10-08
████████ SQL
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2019-10-08
SQL Injection on www.██████████ on countID parameter
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2019-10-08
SSRF on ████████
U.S. Dept Of Defense Server-Side Request Forgery (SSRF) (CWE-918)
High
2019-10-08
Request smuggling on ████████
U.S. Dept Of Defense HTTP Request Smuggling (CWE-444)
High
2019-10-08
Online training material disclosing username and password
U.S. Dept Of Defense Insecure Storage of Sensitive Information (CWE-922)
High
2019-10-08
Open FTP server on a DoD system
U.S. Dept Of Defense File and Directory Information Exposure (CWE-538)
High
2019-10-08
[REMOTE] Full Account Takeover At https://██████████████/CAS/
U.S. Dept Of Defense Reliance on Cookies without Validation and Integrity Checking in a Security Decision (CWE-784)
High
2019-10-04
Path traversal on ████████
U.S. Dept Of Defense Path Traversal (CWE-22)
High
2019-10-04
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239 $9,895