Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports

12,262

CVE-linked

1,866

Programs

343

New This Week

0

Severity: All Critical High Medium Low

Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

Program filter: gitlab✕

Blocked user Git access through CI/CD token

GitLab Improper Access Control - Generic (CWE-284)CVE-2019-15589

Medium

2019-12-13

Container scanning and Dependency scanning report leaked to unauthorized users

GitLab Improper Access Control - Generic (CWE-284)CVE-2019-15591 CVE-2017-18269 CVE-2017-16997 CVE-2018-1000001 CVE-2016-10228 CVE-2018-18520 CVE-2010-4052 CVE-2018-16869 CVE-2018-18311 CVE-2014-3488 CVE-2017-12794 CVE-2018-1000201

Medium

2019-12-13

Head pipeline leaked to unauthorized users via blocking merge request feature

GitLab Improper Access Control - Generic (CWE-284)CVE-2019-15580

Low

2019-12-13

GraphQL query "namespace" leaks data

GitLab Improper Access Control - Generic (CWE-284)

Medium

2019-12-03

Bypassing push rules via MRs created by Email

GitLab Improper Access Control - Generic (CWE-284)

Medium

2019-10-01

Access Projects And create projects in gitlab pre production server

GitLab Improper Access Control - Generic (CWE-284)

Low

2019-08-28

Milestones leaked via search API

GitLab Improper Access Control - Generic (CWE-284)

Low

2019-07-19

Attacker is able to access commit title and team member comments which are supposed to be private

GitLab Improper Access Control - Generic (CWE-284)

High

2019-07-03

Removing a user from a private group doesn't remove him from group's project, if his project's role was changed

GitLab Improper Access Control - Generic (CWE-284)

Medium

2019-04-05

Exfiltrate and mutate repository and project data through injected templated service

GitLab Improper Access Control - Generic (CWE-284)

Critical

2019-03-05

GitHub import allows user to create child group under existing namespace

GitLab Improper Access Control - Generic (CWE-284)CVE-2017-0919

High

2018-05-24

Top Weakness Types

Most Active Programs

Program	Reports	Max $
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	$2,257
HackerOne	609	—
Nextcloud	584	—
Shopify	465	—
curl	464	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$7,000
Uber	239	—