目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,232
关联 CVE
1,859
参与项目数
342
近 7 天新增
13
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Resource Consumption DOS on Edgemax v1.10.6
Ubiquiti Inc. Uncontrolled Resource Consumption (CWE-400)
High
2019-08-04
Gateway information leakage
U.S. Dept Of Defense Privacy Violation (CWE-359)
High
2019-07-30
IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/users
PayPal Insecure Direct Object Reference (IDOR) (CWE-639)
High
2019-07-30
Nginx misconfiguration leading to direct PHP source code download
GSA Bounty Information Disclosure (CWE-200)
High
2019-07-29
In Dockerized Environments, Failing to Read config.php Grants Any Anonymous User Full Admin Access
Nextcloud Improper Access Control - Generic (CWE-284)
High
2019-07-27
Add users to groups who have restricted group invites
WordPress Improper Access Control - Generic (CWE-284)
High
2019-07-27
[okmedia.insideok.ru] Web Cache Poisoing & XSS
ok.ru Cross-site Scripting (XSS) - Stored (CWE-79)
High
2019-07-23
WordPress Automatic Update Protocol Does Not Authenticate Updates Provided by the Server
WordPress Cryptographic Issues - Generic (CWE-310)
High
2019-07-22
Persistent XSS in Note objects
GitLab Cross-site Scripting (XSS) - Stored (CWE-79)
High
2019-07-19
Stored XSS Vulnerability
WordPress Cross-site Scripting (XSS) - Stored (CWE-79)
High
2019-07-18
`socket` command allows sending data over WebSockets to arbitrary origins from Grammarly Extension
Superhuman (formerly Grammarly)
High
2019-07-15
[https://life.informatica.com] - information disclose
Informatica Information Disclosure (CWE-200)
High
2019-07-12
Бесконечный доступ к аккаунту если мы смогли хотя бы раз зайти на аккаунт.
VK.com Privilege Escalation (CAPEC-233)
High
2019-07-11
Просмотр любых статей по их айди.
VK.com Information Disclosure (CWE-200)
High
2019-07-11
Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv
Vimeo Improper Access Control - Generic (CWE-284)
High
2019-07-10
[http-file-server] List any files and sub folders in the folder by using path traversal.
Node.js third-party modules Path Traversal (CWE-22)CVE-2019-5447
High
2019-07-10
Locked_Transfer functional burning
Monero
High
2019-07-09
Gaining unlimited bonus points on websites with WooCommerce Points and Rewards
Automattic Business Logic Errors (CWE-840)
High
2019-07-05
Attacker is able to access commit title and team member comments which are supposed to be private
GitLab Improper Access Control - Generic (CWE-284)
High
2019-07-03
CryptoNote: remote node DoS
Monero Uncontrolled Resource Consumption (CWE-400)
High
2019-07-03
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud583—
Shopify464—
curl447—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—