目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,221
关联 CVE
1,854
参与项目数
342
近 7 天新增
4
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Access to microtransaction sales data for lots of apps from 2014 to present at /valvefinance/sanity/
Valve Improper Access Control - Generic (CWE-284)
Critical
2021-09-21
Create free Shopify application credits.
Shopify Improper Access Control - Generic (CWE-284)
Medium
2021-09-10
Access to alerta.khanacademy.org leak sensitive data
Khan Academy Improper Access Control - Generic (CWE-284)
Critical
2021-09-08
Node Validation Admission does not observe all oldObject fields
Kubernetes Improper Access Control - Generic (CWE-284)
Medium
2021-09-05
Subdomain takeover due to non registered TLD [ ██████████.█████.██████.com ]
Affirm Improper Access Control - Generic (CWE-284)
Low
2021-08-31
Bypass of the installation sandbox by injecting keystrokes with TIOCSTI
Homebrew Improper Access Control - Generic (CWE-284)
Low
2021-08-30
A deactivated user can access data through GraphQL
GitLab Improper Access Control - Generic (CWE-284)
Medium
2021-08-30
URN Request bypass ACL Checks
Internet Bug Bounty Improper Access Control - Generic (CWE-284)CVE-2019-12523
Critical
2021-08-26
S3 bucket listing/download
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)
Medium
2021-08-19
IP-in-IP protocol routes arbitrary traffic by default - CVE-2020-10136
Internet Bug Bounty Improper Access Control - Generic (CWE-284)CVE-2020-10136
Medium
2021-08-15
Client IP Spoofing using "X-Forwarded-For: 127.0.0.1" on "studio-app.snapchat.com" exposing bucket details
Snapchat Improper Access Control - Generic (CWE-284)
High
2021-08-12
Webauthn tokens are not removed on user deletion
Nextcloud Improper Access Control - Generic (CWE-284)CVE-2021-32726
Medium
2021-08-07
Virtual Data Room / Hide download on collabora is easy to bypass
Nextcloud Improper Access Control - Generic (CWE-284)CVE-2021-32748
High
2021-08-07
Private program disclosure through notifications
HackerOne Improper Access Control - Generic (CWE-284)
Low
2021-08-05
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access
Elastic Improper Access Control - Generic (CWE-284)
High
2021-08-03
Publicly accessible Continuous Integration Tool
Snapchat Improper Access Control - Generic (CWE-284)
Critical
2021-07-29
Enumerate all the class codes via google dorking
Khan Academy Improper Access Control - Generic (CWE-284)
High
2021-07-22
Broken Authentication and Session Management lead to take over account
Phabricator Improper Access Control - Generic (CWE-284)
High
2021-07-21
Scoped apptokens can be changed by that very apptoken
Nextcloud Improper Access Control - Generic (CWE-284)CVE-2021-32688
High
2021-07-15
No Rate Limit On Forgot Password Page
Acronis Improper Access Control - Generic (CWE-284)
Medium
2021-07-09
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239—