目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1000 CNY

100.0%
コーヒーを一杯おごる

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,222
关联 CVE
1,855
参与项目数
342
近 7 天新增
5
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：veris✕
Password reset link is not Expiring
Veris Violation of Secure Design Principles (CWE-657)
Unknown
2016-06-12
Multiple Stored XSS
Veris Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2016-06-12
Multiple Stored XSS on Sanbox.veris.in through Veris Frontdesk Android App
Veris Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2016-06-12
Missing Server Side Validation of CSRF Middleware Token in Change Password Request
Veris Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-06-12
Critical IDOR - Can select any Parent while creating new Venue
Veris Privilege Escalation (CAPEC-233)
Unknown
2016-06-12
Critical IDOR - Get Rules of any organization remotely
Veris Privilege Escalation (CAPEC-233)
Unknown
2016-06-12
Critical IDOR - Make Rule for Any Group & Any Venue remotely
Veris Privilege Escalation (CAPEC-233)
Unknown
2016-06-12
Critical IDOR - Get venue data of any organization remotely
Veris Privilege Escalation (CAPEC-233)
Unknown
2016-06-12
Unauthenticated CSRF(User can input any value for CSRF Token)
Veris Cross-Site Request Forgery (CSRF) (CWE-352)
Unknown
2016-06-08
[Stored XSS] sandbox.veris.in
Veris Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2016-05-26
Text injection can be used in phishing 404 page and should not include attacker text
Veris Violation of Secure Design Principles (CWE-657)
Unknown
2016-05-17
XSS in Asset name
Veris Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2016-05-13
Stored XSS on 'Badges' page
Veris Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2016-05-13
Captcha Bypass enable login bruteforce
Veris Improper Authentication - Generic (CWE-287)
Unknown
2016-05-13
Password(s) can be found via login process.
Veris Improper Authentication - Generic (CWE-287)
Unknown
2016-05-13
Complete or Edit Another User's Profile
Veris Improper Authentication - Generic (CWE-287)
Unknown
2016-05-13
Stored XSS in member book
Veris Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2016-05-13
Server and PHP version Disclosed in Response Header
Veris Information Disclosure (CWE-200)
Unknown
2016-05-04
Stored XSS in Access Rules
Veris Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2016-05-04
www.veris.in DOM based XSS
Veris Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2016-04-22
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud583—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239—