目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1020 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,244
关联 CVE
1,864
参与项目数
343
近 7 天新增
23
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
XXE in Site Audit function exposing file and directory contents
Semrush XML External Entities (XXE) (CWE-611)
Critical
2018-03-13
[serve] Directory listing and File access even when they have been set to be ignored.
Node.js third-party modules Information Exposure Through Directory Listing (CWE-548)CVE-2018-3718
Critical
2018-03-13
новенькое (старенькое upgreid) хакерство: делаем демократию во всем в контакте (XSS - на англиском)
VK.com Cross-site Scripting (XSS) - Stored (CWE-79)
Critical
2018-03-04
SSRF in https://www.zomato.com████ allows reading local files and website source code
Eternal Server-Side Request Forgery (SSRF) (CWE-918)
Critical
2018-02-28
[simplehttpserver] Stored XSS in file names leads to malicious JavaScript code execution when directory listing is output in HTML
Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2018-3716
Critical
2018-02-26
[anywhere] An iframe element with url to malicious HTML file (with eg. JavaScript malware) can be used as filename and served via anywhere
Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2018-3717
Critical
2018-02-26
[http://www.informatica.com]- info disclosure
Informatica Information Disclosure (CWE-200)
Critical
2018-02-26
Backup Source Code Detected
VK.com Information Disclosure (CWE-200)
Critical
2018-02-24
[crud-file-server] Stored XSS in filenames when directory index is served by crud-file-server
Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2018-3726
Critical
2018-02-17
[html-janitor] Passing user-controlled data to clean() leads to XSS
Node.js third-party modules Cross-site Scripting (XSS) - DOM (CWE-79)CVE-2017-0931
Critical
2018-02-09
Ability to bypass partner email confirmation to take over any store given an employee email
Shopify Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Critical
2018-02-07
CI for [example.gov] can be logged in and accessible
GSA Bounty Improper Access Control - Generic (CWE-284)
Critical
2018-02-07
[https://reviews.zomato.com] Time Based SQL Injection
Eternal SQL Injection (CWE-89)
Critical
2018-02-02
Fastify denial-of-service vulnerability with large JSON payloads
Node.js third-party modules Uncontrolled Resource Consumption (CWE-400)CVE-2018-3711
Critical
2018-01-25
[serve] Directory index of arbitrary folder available due to lack of sanitization of %2e and %2f characters in url
Node.js third-party modules Path Traversal (CWE-22)CVE-2018-3712
Critical
2018-01-23
Development configuration file
Pushwoosh Information Disclosure (CWE-200)
Critical
2018-01-18
[marketplace.informatica.com] - Template Injection
Informatica Code Injection (CWE-94)
Critical
2018-01-02
muber-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint
Uber Cross-site Scripting (XSS) - Reflected (CWE-79)
Critical
2017-12-26
lite:sess Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint
Uber Cross-site Scripting (XSS) - Reflected (CWE-79)
Critical
2017-12-26
udi-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint
Uber Cross-site Scripting (XSS) - Reflected (CWE-79)
Critical
2017-12-26
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609 $1,500
Nextcloud583—
Shopify464—
curl457—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—