目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,221
关联 CVE
1,854
参与项目数
342
近 7 天新增
7
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Avatar image upload and bypass real image verification
Nextcloud Violation of Secure Design Principles (CWE-657)
Unknown
2017-01-15
URI scheme bypass in mail app lead to HTML content spoof and opener control
Nextcloud Violation of Secure Design Principles (CWE-657)
Unknown
2017-01-12
Vulnerable Javascript library
CodeIgniter Violation of Secure Design Principles (CWE-657)
None
2017-01-10
[iOS/Android] Address Bar Spoofing Vulnerability
Brave Software Violation of Secure Design Principles (CWE-657)CVE-2016-9473
Unknown
2017-01-08
Content Injection error page
Coinbase Violation of Secure Design Principles (CWE-657)
Unknown
2017-01-05
Deleting Key-value pair from Frozen HASH or Clearing a Frozen HASH
shopify-scripts Violation of Secure Design Principles (CWE-657)
None
2017-01-05
Username can be used to trick the victim on the name of www.gratipay.com
Gratipay Violation of Secure Design Principles (CWE-657)
Unknown
2016-12-30
Username Restriction is not applied for reserved folders
Gratipay Violation of Secure Design Principles (CWE-657)
Unknown
2016-12-30
HTTP OPTION Method is Enabled on portswigger.net
PortSwigger Web Security Violation of Secure Design Principles (CWE-657)
Low
2016-12-27
Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)
HackerOne Violation of Secure Design Principles (CWE-657)
None
2016-12-08
[Nextcloud 9.0.53] Content Spoofing in 'trustDomain' parameter
Nextcloud Violation of Secure Design Principles (CWE-657)
Unknown
2016-12-05
Login Hints on Admin Panel
Nextcloud Violation of Secure Design Principles (CWE-657)
Medium
2016-12-05
Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/
Nextcloud Violation of Secure Design Principles (CWE-657)CVE-2016-9468
Low
2016-12-02
ByPassing the email Validation Email on Sign up process in mobile apps
Coinbase Violation of Secure Design Principles (CWE-657)
Unknown
2016-11-28
Access to Amazon S3 bucket
DigitalSellz Violation of Secure Design Principles (CWE-657)
Unknown
2016-11-27
No CAPTCHA ia exist in pages
Ian Dunn Violation of Secure Design Principles (CWE-657)
None
2016-11-23
Bypass the resend limit in Send Invites
Pushwoosh Violation of Secure Design Principles (CWE-657)
Medium
2016-11-22
Missing Rate limiting for sensitive actions (like "forgot password") and reCaptcha error.
bitaccess Violation of Secure Design Principles (CWE-657)
Unknown
2016-11-21
RC4 cipher suites detected on status.slack.com
Slack Violation of Secure Design Principles (CWE-657)
Unknown
2016-11-18
Runtime manipulation iOS app breaking the PIN
Coinbase Violation of Secure Design Principles (CWE-657)
Unknown
2016-11-16
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239 $9,895