漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,247

关联 CVE

1,864

参与项目数

343

近 7 天新增

25

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

[spectacles.com] Bypassing quantity limit in orders

Snapchat HTTP Request Smuggling (CWE-444)

Medium

2017-08-12

heap-use-after-free in Sass::SharedPtr::incRefCount()

LibSass Use After Free (CWE-416)

Medium

2017-08-10

ap_find_token() Buffer Overread

Internet Bug Bounty Buffer Over-read (CWE-126)CVE-2017-7668

Medium

2017-08-10

Brave: Admin Panel Access

Brave Software Violation of Secure Design Principles (CWE-657)

Medium

2017-08-10

Clickjacking or URL Masking

Brave Software Improper Authentication - Generic (CWE-287)

Medium

2017-08-10

Address bar spoofing in Brave browser via. window close warnings

Brave Software Violation of Secure Design Principles (CWE-657)

Medium

2017-08-10

[Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge [Team Vector]

WakaTime Privilege Escalation (CAPEC-233)

Medium

2017-08-10

[Privilege Escalation] Authenticated users can manipulate others fullname without their knowledge

WakaTime Privilege Escalation (CAPEC-233)

Medium

2017-08-10

Ability to post comments to a crew even after getting kicked out

Rockstar Games Violation of Secure Design Principles (CWE-657)

Medium

2017-08-08

Full Api Access and Run All Functions via Starbucks App

Starbucks Improper Authentication - Generic (CWE-287)

Medium

2017-08-06

Bypassing Access control, changing owner's name in a private leaderboard

WakaTime Improper Access Control - Generic (CWE-284)

Medium

2017-07-31

Missing link to TOTP manual enroll option

Legal Robot Business Logic Errors (CWE-840)

Medium

2017-07-31

Enhancement: email confirmation for 2FA recovery

Legal Robot Business Logic Errors (CWE-840)

Medium

2017-07-31

Big XSS vulnerability!

Legal Robot Classic Buffer Overflow (CWE-120)

Medium

2017-07-30

Stored XSS in Pages SEO dialog Name field (concrete5 8.1.0)

Concrete CMS Cross-site Scripting (XSS) - Stored (CWE-79)

Medium

2017-07-27

[connect.teavana.com] Open Redirect and abuse of connect.teavana.com

Starbucks Open Redirect (CWE-601)

Medium

2017-07-27

Reading redacted data via hackbot's answers

HackerOne Information Disclosure (CWE-200)

Medium

2017-07-27

XXE on sms-be-vip.twitter.com in SXMP Processor

X / xAI XML External Entities (XXE) (CWE-611)

Medium

2017-07-26

Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter

WordPress Cross-site Scripting (XSS) - Reflected (CWE-79)

Medium

2017-07-26

Reflected XSS in openapi.starbucks.com /searchasyoutype/v1/search?x-api-key=

Starbucks Cross-site Scripting (XSS) - Generic (CWE-79)

Medium

2017-07-25

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	$2,257
HackerOne	609	—
Nextcloud	584	—
Shopify	464	—
curl	457	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	—