目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,222
关联 CVE
1,855
参与项目数
342
近 7 天新增
3
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Improper Access Control - Generic on https://████
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)
High
2021-04-02
External Service Interaction (HTTP/DNS) on https://www.███ (██████████ parameter)
U.S. Dept Of Defense Server-Side Request Forgery (SSRF) (CWE-918)
High
2021-04-02
XML Injection on https://www.█████████ (███ parameter)
U.S. Dept Of Defense XML Injection (CWE-91)
High
2021-04-02
Read-only path traversal (CVE-2020-3452) at https://██████.mil
U.S. Dept Of Defense Path Traversal (CWE-22)CVE-2020-3452
High
2021-04-02
SocialClub Account Take Over Through Import Friends feature
Rockstar Games Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-04-01
[Fixed] A vulnerability in KAVKIS 2020 products family allows full disabling of protection
Kaspersky Code Injection (CWE-94)
High
2021-03-31
Reset any password
pixiv Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
High
2021-03-31
Unrestricted access to quiesce functionality in dss.api.playstation.com REST API leads to unavailability of application
PlayStation Missing Authorization (CWE-862)
High
2021-03-30
Reflected XSS on transact.playstation.com using postMessage from the opening window
PlayStation Cross-site Scripting (XSS) - Reflected (CWE-79)
High
2021-03-30
SSRF chained to hit internal host leading to another SSRF which allows to read internal images.
PlayStation Server-Side Request Forgery (SSRF) (CWE-918)
High
2021-03-30
Stored XSS in any message (leads to priv esc for all users and file leak + rce via electron app)
Rocket.Chat Cross-site Scripting (XSS) - DOM (CWE-79)CVE-2021-22886
High
2021-03-25
Git repo on https://██████.mil/ discloses API password
U.S. Dept Of Defense Password in Configuration File (CWE-260)
High
2021-03-24
[CVE-2018-7600] Remote Code Execution due to outdated Drupal server on www.█████████
U.S. Dept Of Defense Command Injection - Generic (CWE-77)CVE-2018-7600
High
2021-03-24
Android App Crashes while sending message to users/ on channel
Rocket.Chat Classic Buffer Overflow (CWE-120)
High
2021-03-18
Ability To Delete User(s) Account Without User Interaction
GitLab Misconfiguration (CWE-16)
High
2021-03-17
Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service)
Acronis Privilege Escalation (CAPEC-233)
High
2021-03-16
ClickJacking
Acronis UI Redressing (Clickjacking) (CAPEC-103)
High
2021-03-16
SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partners
Uber SQL Injection (CWE-89)
High
2021-03-15
Reflected XSS on https://www.uber.com
Uber
High
2021-03-15
[plain-object-merge] Prototype pollution
Node.js third-party modules Modification of Assumed-Immutable Data (MAID) (CWE-471)
High
2021-03-13
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud583—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—