漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,222

关联 CVE

1,855

参与项目数

342

近 7 天新增

3

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

Team admin can add billing contacts

Slack Privilege Escalation (CAPEC-233)

Unknown

2015-04-03

CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`.

Vimeo Privilege Escalation (CAPEC-233)

Unknown

2015-03-18

A user can post comments on other user's private videos

Vimeo Privilege Escalation (CAPEC-233)

Unknown

2015-03-11

A user can edit comments even after video comments are disabled

Vimeo Privilege Escalation (CAPEC-233)

Unknown

2015-03-11

Fabric.io - an app admin can delete team members from other user apps

X / xAI Privilege Escalation (CAPEC-233)

Unknown

2015-03-09

fabric.io - app member can make himself an admin

X / xAI Privilege Escalation (CAPEC-233)

Unknown

2015-03-09

Team member invitations to sandboxed teams are not invalidated consistently (v2)

HackerOne Privilege Escalation (CAPEC-233)

Unknown

2015-02-27

profile photo update bypass

Vimeo Privilege Escalation (CAPEC-233)

Unknown

2015-02-17

Buying ondemand videos that 0.1 and sometimes for free

Vimeo Privilege Escalation (CAPEC-233)

Unknown

2015-02-13

Change Any username and profile link in hackerone

HackerOne Privilege Escalation (CAPEC-233)

Unknown

2014-09-25

privilege escalation

Mavenlink Privilege Escalation (CAPEC-233)

Unknown

2014-08-05

Abusing daemon logs for Privilege escalation under certain scenarios

Phabricator Privilege Escalation (CAPEC-233)

Unknown

2014-06-18

Abusing VCS control on phabricator

Phabricator Privilege Escalation (CAPEC-233)

Unknown

2014-06-13

Making groups in any project without permission

Localize Privilege Escalation (CAPEC-233)

Unknown

2014-04-20

Deleting groups in any project without permission

Localize Privilege Escalation (CAPEC-233)

Unknown

2014-04-20

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	—
HackerOne	609	—
Nextcloud	583	—
Shopify	464	—
curl	440	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	—