Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1110 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,247
CVE-linked
1,864
Programs
343
New This Week
23
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
[avito.ru] Утекают креды от платежных провайдеров
Avito Information Disclosure (CWE-200)
Critical
2018-12-24
lert.uber.com: Few default folders/files of AURA Framework are accessible
Uber Information Disclosure (CWE-200)
None
2018-12-19
Information Disclosure on https://theendlessweb.com/
RATELIMITED Information Disclosure (CWE-200)
Unknown
2018-12-15
Banner Grabbing - Apache Server Version Disclousure
RATELIMITED Information Disclosure (CWE-200)
Medium
2018-12-11
information disclosure which leak the apache version
RATELIMITED Information Disclosure (CWE-200)
Low
2018-12-11
Inline banner on Report page discloses whether organization runs a private program
HackerOne Information Disclosure (CWE-200)
Low
2018-12-11
Unauthorized users may be able to view almost all informations related to Private projects.
GitLab Information Disclosure (CWE-200)
Medium
2018-12-03
Possible SSRF at URL Parameter while creating a new package repository
GoCD Information Disclosure (CWE-200)
Unknown
2018-11-30
Attacker can claim credentials for private program that has a published external program
HackerOne Information Disclosure (CWE-200)
Medium
2018-11-29
Full path disclosure on track.uber.com
Uber Information Disclosure (CWE-200)
Low
2018-11-20
PII disclosure -- Past team members & their email ID(personal email) can be viewed by Staff member with no permissions on Partner Dashboard
Shopify Information Disclosure (CWE-200)
Low
2018-11-08
Disclosure of Github Issues
Shopify Information Disclosure (CWE-200)
Medium
2018-11-08
Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature
HackerOne Information Disclosure (CWE-200)
Low
2018-11-07
[staging-engineering.gnip.com] Publicly accessible GIT directory
X / xAI Information Disclosure (CWE-200)
Medium
2018-11-01
Расшифровка всех типов шифрованных ID
Bumble Information Disclosure (CWE-200)
Medium
2018-11-01
Smuggle SocialClub's Facebook OAuth Code via Referer Leakage
Rockstar Games Information Disclosure (CWE-200)
Medium
2018-10-23
Exploiting Misconfigured CORS to Steal User Information
Rockstar Games Information Disclosure (CWE-200)
High
2018-10-17
Compromising the user ID
Bumble Information Disclosure (CWE-200)
High
2018-10-07
A 10GB file is reachable
Chaturbate Information Disclosure (CWE-200)
None
2018-10-01
Browser Self XSS Protection not implemented
PortSwigger Web Security Information Disclosure (CWE-200)
Unknown
2018-09-26
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify464—
curl457—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—