漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,245

关联 CVE

1,864

参与项目数

343

近 7 天新增

23

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

SSRF vulnerability in gitlab.com via project import.

GitLab Server-Side Request Forgery (SSRF) (CWE-918)

Medium

2017-11-09

Stored XSS in content when Graph is created via API

Infogram Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-11-07

Bruteforcing password reset tokens, could lead to account takeover

Instacart Improper Restriction of Authentication Attempts (CWE-307)

Medium

2017-11-06

No Email Verification

Infogram Improper Certificate Validation (CWE-295)

Medium

2017-11-03

[IRCCloud Android] Opening arbitrary URLs/XSS in SAMLAuthActivity

Medium

2017-11-03

[IRCCloud Android] XSS in ImageViewerActivity

Medium

2017-11-03

stored xss in invited team member via email parameter

Shopify Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-11-03

CSV injection in gratipay.com via payment history export feature.

Gratipay Command Injection - Generic (CWE-77)

Medium

2017-11-03

Key Reinstallation Attacks: Breaking WPA2 by forcing nonce reuse

Internet Bug Bounty Reusing a Nonce, Key Pair in Encryption (CWE-323)CVE-2017-13077 CVE-2017-13078 CVE-2017-13079 CVE-2017-13080 CVE-2017-13081 CVE-2017-13082 CVE-2017-13084 CVE-2017-13086 CVE-2017-13087 CVE-2017-13088

Medium

2017-11-03

OS Command Execution on User's PC via CSV Injection

X / xAI OS Command Injection (CWE-78)

Medium

2017-11-02

Unauthenticated hidden groups disclosure via Ajax groups search

WordPress Improper Access Control - Generic (CWE-284)

Medium

2017-11-02

Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE.

Medium

2017-11-02

View Any Program's Team Members through GET https://hackerone.com/invitations/

HackerOne Information Disclosure (CWE-200)

Medium

2017-11-01

CSRF to change Account Security Keys on secure.login.gov

GSA Bounty Cross-Site Request Forgery (CSRF) (CWE-352)

Medium

2017-11-01

Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification

HackerOne Business Logic Errors (CWE-840)

Medium

2017-11-01

XSS when Shared

Infogram Cross-site Scripting (XSS) - Reflected (CWE-79)

Medium

2017-11-01

Sensitive information is publicly available

Infogram Cleartext Storage of Sensitive Information (CWE-312)

Medium

2017-10-31

Stored XSS on support.rockstargames.com

Rockstar Games Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-10-30

Blind SSRF in emblem editor (2)

Rockstar Games Server-Side Request Forgery (SSRF) (CWE-918)

Medium

2017-10-28

WebSummit Cross-site Scripting (XSS) - Generic (CWE-79)

Medium

2017-10-28

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	$2,257
HackerOne	609	—
Nextcloud	584	—
Shopify	464	—
curl	457	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	—