Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,222
CVE-linked
1,855
Programs
342
New This Week
5
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
External Service Interaction | https://█████████.mil
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2020-10-16
Uninitialized read in exif_process_IFD_in_MAKERNOTE
Internet Bug Bounty Information Disclosure (CWE-200)CVE-2019-9638
High
2020-10-10
Dropcontact's disclosed report is exposing Private/Confidential information
Dropcontact Information Disclosure (CWE-200)
High
2020-08-20
Default Creds Spring Boot Admin
8x8 Information Disclosure (CWE-200)
High
2020-08-14
S3 bucket data at http://rockset-support.s3-us-west-2.amazonaws.com/ reveals user addresses based on latitudes and longitudes.
Rockset Information Disclosure (CWE-200)
High
2020-08-05
Hardcoded credentials in Android App
8x8 Information Disclosure (CWE-200)
High
2020-06-22
Source code disclosure at ███
RATELIMITED Information Disclosure (CWE-200)
High
2020-06-20
Sensitive data disclosure via exposed phpunit file
8x8 Information Disclosure (CWE-200)
High
2020-06-09
Customer private program can disclose email any users through invited via username
HackerOne Information Disclosure (CWE-200)
High
2020-05-15
Username&password is Disclosure in readme file in [https://█████████]
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2020-05-14
Admin Login Credential Leak for DoD Gitlab EE instance
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2020-05-14
Publicly accessible Grafana install allows pivoting to Prometheus datasource
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2020-05-14
PII of Users Disclosure using "/members/invite/" endpoint
Lab45 Information Disclosure (CWE-200)
High
2020-04-13
Information disclousure by clicking on the link shown in http://████████/
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-12-02
LFI through the MySQL connection
Infogram Information Disclosure (CWE-200)
High
2019-11-12
Access MoPub Reports Data even after Company removed you from their MoPub Account.
X / xAI Information Disclosure (CWE-200)
High
2019-11-05
Information Disclosure (can access all ███s) within ███████ view █████████ Portal
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-08
Publicly accessible Order confirmations leaking User Emails on ███
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-08
PII leakage due to caching of Order/Contract ID's on █████████
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-08
██████ Authenticated User Data Disclosure
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2019-10-04
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud583—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239—