目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,222
关联 CVE
1,855
参与项目数
342
近 7 天新增
3
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
CVE-2017-13040 The MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions.
Internet Bug Bounty Buffer Over-read (CWE-126)CVE-2017-13040
High
2021-07-09
CVE-2017-13041 The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().
Internet Bug Bounty Buffer Over-read (CWE-126)CVE-2017-13041
High
2021-07-09
Cache Posioning leading do Denial of Service on `www.█████████`
U.S. Dept Of Defense Uncontrolled Resource Consumption (CWE-400)
High
2021-07-09
API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers.
Uber Information Disclosure (CWE-200)
High
2021-07-08
Bypass the fix of report #1078283 due to poor validation
Khan Academy Open Redirect (CWE-601)
High
2021-07-08
DNS Leaks when using any VPN Browser extension with Brave Shield enabled
Brave Software Information Disclosure (CWE-200)CVE-2021-22916
High
2021-07-08
Slack integration setup lacks CSRF protection
HackerOne Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-07-07
IDOR while uploading ████ attachments at [█████████]
U.S. Dept Of Defense Insecure Direct Object Reference (IDOR) (CWE-639)
High
2021-06-30
Post-Auth Stored XSS with User Interaction leads to Remote Code Execution
Rocket.Chat Cross-site Scripting (XSS) - Stored (CWE-79)
High
2021-06-30
Responsible Disclosure of Privacy Leakage Issue
GitLab Privacy Violation (CWE-359)
High
2021-06-29
Server-side Template Injection in lodash.js
Node.js third-party modules Code Injection (CWE-94)
High
2021-06-28
Prototype Pollution Vulnerability in noble Package
Node.js third-party modules
High
2021-06-28
Bypass of SSRF Vulnerability
Node.js third-party modules Server-Side Request Forgery (SSRF) (CWE-918)
High
2021-06-28
Subdomain takeover of v.zego.com
Zego Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
High
2021-06-26
Firebase Database Takeover in Zego Sense Android app
Zego Improper Authentication - Generic (CWE-287)
High
2021-06-23
SQL injection on admin.acronis.host development web service
Acronis SQL Injection (CWE-89)
High
2021-06-22
Brave Browser Tor Window leaks user's real IP to the external DNS server
Brave Software Information Disclosure (CWE-200)CVE-2021-22917
High
2021-06-17
Denial of service via cache poisoning on https://www.data.gov/
GSA Bounty
High
2021-06-15
XML Injection / External Service Interaction (HTTP/DNS) On https://█████████.mil
U.S. Dept Of Defense XML Injection (CWE-91)
High
2021-06-15
Cross-origin resource sharing misconfig | steal user information
UPchieve Information Disclosure (CWE-200)
High
2021-06-15
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud583—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—