目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,221
关联 CVE
1,854
参与项目数
342
近 7 天新增
4
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
CSRF protection bypass on TikTok Webcast Endpoints
TikTok Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2023-07-12
Asset Inventory Internal Descriptions are leaked in CSV export
HackerOne Business Logic Errors (CWE-840)
Medium
2023-07-12
Rate limit missing sign-in page
Tennessee Valley Authority Improper Restriction of Authentication Attempts (CWE-307)
Medium
2023-07-11
xss(r) vcc-na11.8x8.com
8x8 Cross-site Scripting (XSS) - Reflected (CWE-79)
Medium
2023-07-10
ActionView sanitize helper bypass leading to XSS using SVG tag.
Ruby on Rails Cross-site Scripting (XSS) - Generic (CWE-79)CVE-2022-23515CVE-2022-23518
Medium
2023-07-10
Arbitrary file write triggered by deeplink abuse - MetaMask Android
MetaMask Business Logic Errors (CWE-840)
Medium
2023-07-07
Banned user still able to invited to reports as a collabrator and reset the password
HackerOne Improper Access Control - Generic (CWE-284)
Medium
2023-07-06
Internal machine learning API endpoint for CWE classification is vulnerable to path traversal
HackerOne Path Traversal (CWE-22)
Medium
2023-07-05
inDriver Job - Admin Approval Bypass
inDrive Incorrect Authorization (CWE-863)
Medium
2023-07-05
wp-embed XSS on Safari
WordPress Cross-site Scripting (XSS) - DOM (CWE-79)
Medium
2023-07-01
Blind Sql Injection https:/████████
U.S. Dept Of Defense SQL Injection (CWE-89)
Medium
2023-06-30
DiffieHellman doesn't generate keys after setting a key
Internet Bug Bounty Cryptographic Issues - Generic (CWE-310)CVE-2023-30590
Medium
2023-06-30
Escape Sequence Injection vulnerability in Rack
Ruby on Rails CVE-2022-30123
Medium
2023-06-28
Possible DOS in app with crashing `exceptions_app`
Ruby on Rails Uncontrolled Resource Consumption (CWE-400)
Medium
2023-06-28
Stored XSS on wordpress.com
Automattic Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2023-06-26
CVE-2023-28319: UAF in SSH sha256 fingerprint check
Internet Bug Bounty Use After Free (CWE-416)CVE-2023-28319
Medium
2023-06-25
Federated share permissions can be increased by recipient
ownCloud
Medium
2023-06-24
Docker Registry without authentication leads to docker images download
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)
Medium
2023-06-23
███████ ' can delete any animal from other account ' at ██████████
Mars Insecure Direct Object Reference (IDOR) (CWE-639)
Medium
2023-06-23
Stored XSS via ' profile ' at ███
Mars Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2023-06-23
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239—