漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,244

关联 CVE

1,864

参与项目数

343

近 7 天新增

23

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation

Medium

2024-09-19

Bypass comment restriction

HackerOne Improper Access Control - Generic (CWE-284)

Medium

2024-09-19

IDOR Leads To User Profile Modification https://mtnmobad.mtnbusiness.com.ng/app/updateUser

MTN Group Incorrect Authorization (CWE-863)

Critical

2024-09-18

Removed Guest role user who dosent have access to private project in members able to view jobs

GitLab Improper Authorization (CWE-285)

None

2024-09-18

Brave Android: Incorrect URL Eliding in Brave Shields Pop Up

Brave Software Violation of Secure Design Principles (CWE-657)CVE-2024-37406

Low

2024-09-18

Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-check

GitHub Command Injection - Generic (CWE-77)CVE-2024-1359

High

2024-09-17

RC Between GitHub's Repo Update REST API and updateTeamsRepository GraphQL Mutation Results in Covert and Persistent Admin Access Retention

GitHub Misconfiguration (CWE-16)CVE-2024-2440

Medium

2024-09-17

Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectd

GitHub Command Injection - Generic (CWE-77)CVE-2024-1369

High

2024-09-17

Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-console

GitHub Command Injection - Generic (CWE-77)CVE-2024-1355

High

2024-09-17

Private draft report exposure in a program a user is added as a viewer to

HackerOne Information Disclosure (CWE-200)

Medium

2024-09-17

Authentication Bypass Leads To Complete Account TakeveOver on ██████████

MTN Group Authentication Bypass Using an Alternate Path or Channel (CWE-288)

Critical

2024-09-14

Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forward

GitHub Command Injection - Generic (CWE-77)CVE-2024-1374

High

2024-09-13

Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise Server

GitHub CVE-2024-2469

High

2024-09-13

Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection

GitHub Command Injection - Generic (CWE-77)CVE-2024-1378

High

2024-09-13

Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ng

GitHub Command Injection - Generic (CWE-77)CVE-2024-1354

High

2024-09-13

Unauthenticated Varnish Cache Purge

Adobe Misconfiguration (CWE-16)

Low

2024-09-12

CVE-2024-8096: OCSP stapling bypass with GnuTLS

curl Improper Certificate Validation (CWE-295)CVE-2024-8096

Medium

2024-09-11

cross site scripting reflected

MTN Group Cross-site Scripting (XSS) - Reflected (CWE-79)

Medium

2024-09-09

Stored XSS in reclamos

MercadoLibre Cross-site Scripting (XSS) - Stored (CWE-79)

High

2024-09-09

CVE-2024-41937: Apache Airflow: Stored XSS Vulnerability on provider link

Internet Bug Bounty Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2024-41937

Low

2024-09-07

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	$2,257
HackerOne	609	—
Nextcloud	583	—
Shopify	464	—
curl	457	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	—