Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,245
CVE-linked
1,864
Programs
343
New This Week
23
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Github information leaked
Semrush Information Disclosure (CWE-200)
High
2019-09-25
.git file accessible
BlockDev Sp. Z o.o Information Disclosure (CWE-200)
Low
2019-09-13
Stored credentials instantly autofilled within sandboxed iframes
Kaspersky Information Disclosure (CWE-200)
Low
2019-09-10
Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter
Uber Information Disclosure (CWE-200)
High
2019-09-09
Disclosure of Program email Title Report when being removed as contributor. Bypass for Report #645264
HackerOne Information Disclosure (CWE-200)
Low
2019-09-06
Email enumeration at SignUp page
Omise Information Disclosure (CWE-200)
Low
2019-09-04
EXIF Geolocation Data Not Stripped From Uploaded Images
Hiro Information Disclosure (CWE-200)
Low
2019-09-03
Last build status and coverage leaked to unauthorized users
GitLab Information Disclosure (CWE-200)CVE-2019-5463
Low
2019-09-01
Option method enabled in kartpay Webservers
Kartpay Information Disclosure (CWE-200)
Low
2019-08-28
SMTP Failure Leads to Chain of Internal System Failure
Kartpay Information Disclosure (CWE-200)
High
2019-08-28
Program Email Nofication settings ignored when being added as an external contributor
HackerOne Information Disclosure (CWE-200)
Low
2019-08-07
Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.gov
GSA Bounty Information Disclosure (CWE-200)
Low
2019-08-06
Public Github Repo Leaking Internal Credentials Leading To DiscoveryIQ Docker Access
Informatica Information Disclosure (CWE-200)
Critical
2019-08-06
Disclosure of 152 cookie names via crafted input
Automattic Information Disclosure (CWE-200)
Low
2019-08-04
Total bounties paid amount is disclosed because of redesign of the Program Profiles
HackerOne Information Disclosure (CWE-200)
Low
2019-08-02
Nginx misconfiguration leading to direct PHP source code download
GSA Bounty Information Disclosure (CWE-200)
High
2019-07-29
Root user disclosure in data.gov domain though x-amz-meta-s3cmd-attrs header
GSA Bounty Information Disclosure (CWE-200)
Low
2019-07-29
Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lock
Nextcloud Information Disclosure (CWE-200)CVE-2019-5453
Low
2019-07-26
Private information exposed through GraphQL filters
HackerOne Information Disclosure (CWE-200)
Medium
2019-07-23
[https://life.informatica.com] - information disclose
Informatica Information Disclosure (CWE-200)
High
2019-07-12
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify464—
curl457—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—