Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,221
CVE-linked
1,854
Programs
342
New This Week
6
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Csrf on creating course
Udemy Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2017-01-10
Udemy s3 storage can be used by an attacker personal website because of missing CSRF Token
Udemy Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2017-01-05
CSRF csrftoken in cookies
Gratipay Cross-Site Request Forgery (CSRF) (CWE-352)
High
2016-12-07
account.ubnt.com CSRF
Ubiquiti Inc. Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-12-05
Order-phishing via Payment ID URL
PortSwigger Web Security Cross-Site Request Forgery (CSRF) (CWE-352)
Low
2016-11-30
Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com
Ubiquiti Inc. Cross-Site Request Forgery (CSRF) (CWE-352)
High
2016-11-29
[kb.informatica.com] Unauthenticated emails and HTML injection in email messages
Informatica Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2016-11-28
(BYPASS) Open redirect and XSS in supporthiring.shopify.com
Shopify Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-11-21
CSRF in github integration
Slack Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2016-11-18
Possible CSRF during external programs
HackerOne Cross-Site Request Forgery (CSRF) (CWE-352)
Low
2016-10-18
Cross-Site Request Forgery (CSRF)
Instacart Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-10-13
Twitter Disconnect CSRF
Eternal Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-09-30
Send emails to all users using Camptix
Ian Dunn Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-09-27
Payment gateway status transferred to Shopify without authentication
Shopify Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-09-27
Attacker could setup reminder remotely using brute force
Uber Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-09-19
Changing paymentProfileUuid when booking a trip allows free rides
Uber Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-09-15
CSRF To change Email Notification Settings
Instacart Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-09-15
CSRF
Legal Robot Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-09-09
WooCommerce: Support Ticket indirect object reference
Automattic Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-09-02
CSRF Add Album On onpatient.com
drchrono Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-08-31
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239—