目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All Critical High Medium Low
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████]
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
Critical
2024-03-22
Persistent Unauthorized Administrative Access on All Organization Repositories via RC in User Conversion to Organization
GitHub Improper Authentication - Generic (CWE-287) CVE-2023-46649
Medium
2024-03-15
Improper Authentication on Alertmanager instance
IBM Improper Authentication - Generic (CWE-287)
Medium
2024-02-29
Jenkins server access due to weak password
IBM Improper Authentication - Generic (CWE-287)
High
2024-02-29
Vulnerability Report: NO RATE LIMIT Password RESET
Trellix Improper Authentication - Generic (CWE-287)
Low
2024-02-02
default credentials at https://52.42.105.71/
Trellix Improper Authentication - Generic (CWE-287)
Critical
2024-02-01
Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████
Mars Improper Authentication - Generic (CWE-287)
Critical
2024-01-30
Unauthenticated Jenkins instance exposed information related to █████
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
High
2024-01-26
Weak Email Verification: Newly Registered Users Can Bypass Email Verification Step and Log In
Enjin Improper Authentication - Generic (CWE-287)
Medium
2024-01-19
App PIN code can be bypassed in Files iOS
Nextcloud Improper Authentication - Generic (CWE-287) CVE-2023-49790
Low
2023-12-18
access to profile & reset password page without authentication
Tennessee Valley Authority Improper Authentication - Generic (CWE-287)
Medium
2023-11-30
Full account takeover of any user through reset password
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
Medium
2023-11-17
Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seat
Cloudflare Public Bug Bounty Improper Authentication - Generic (CWE-287)
High
2023-10-25
authentication bypass
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
Medium
2023-09-29
No Rate Limit On Forgot Password on https://apps.nextcloud.com
Nextcloud Improper Authentication - Generic (CWE-287)
Unknown
2023-09-26
Unprotected Atlantis Server at https://132.226.█.█
8x8 Improper Authentication - Generic (CWE-287)
Medium
2023-09-15
bypass two-factor authentication.
LinkedIn Improper Authentication - Generic (CWE-287)
Medium
2023-08-01
Bypass for forced re-authentication upon biometrics change
Bitwarden Improper Authentication - Generic (CWE-287)
Medium
2023-07-19
Improper Authentication inside the Rockstar Games Launcher which leads to Account takeover to some extend
Rockstar Games Improper Authentication - Generic (CWE-287)
High
2023-07-05
Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite links
Slack Improper Authentication - Generic (CWE-287)
Critical
2023-06-23
高频漏洞类型
最活跃项目
项目 报告数 最高赏金
U.S. Dept Of Defense 896 —
Internet Bug Bounty 817 $2,257
HackerOne 609 —
Nextcloud 584 —
Shopify 465 —
curl 464 —
Node.js third-party modules 307 —
GitLab 258 —
X / xAI 250 —
Uber 239 —