目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,221
关联 CVE
1,854
参与项目数
342
近 7 天新增
4
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
iframes considered harmful
Coinbase Violation of Secure Design Principles (CWE-657)
Unknown
2015-12-01
IDOR on remoing Share
Enter Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-27
No rate limit which leads to "Users information Disclosure" including verfification documents etc.
Enter Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-27
Potential for financial loss, negative Values for "Buy fee" and "Sell Fee"
Enter Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-26
The csrf token remains same after user logs in
Enter Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-26
owncloud.com: Content Sniffing not disabled
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-11-12
SPF records not found
Coinbase Violation of Secure Design Principles (CWE-657)
Unknown
2015-10-14
owncloud.com: PermError SPF Permanent Error: Too many DNS lookups
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-10-11
owncloud.com: Outdated plugins contains public exploits
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-10-11
Config
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-10-11
Passwords Returned in Later Responses.
Shopify Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-30
[s3.owncloud.com] Web Server HTTP Trace/Track Method Support
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-28
Extremely high Course rating values could be set in order to make really high Average rating of the course. Negative values could be set to.
Udemy Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-25
Weak HSTS age in support hackerone site
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-18
gallery_plus: Content Spoofing
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-11
Password appears in user name field
ownCloud Violation of Secure Design Principles (CWE-657)
Unknown
2015-09-11
Content spoofing through Referel header
Flox Violation of Secure Design Principles (CWE-657)
Unknown
2015-08-29
SSRF via 'Insert Image' feature of Products/Collections/Frontpage
Shopify Violation of Secure Design Principles (CWE-657)
Unknown
2015-08-24
Gain reputation by creating a duplicate of an existing report
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2015-08-14
Improper Verification of email address while saving Account Settings
X / xAI Violation of Secure Design Principles (CWE-657)
Unknown
2015-08-13
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239—