目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,240
关联 CVE
1,863
参与项目数
342
近 7 天新增
20
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
stored xss in scrape-metadata when reading metadata from an html page
Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)
High
2018-07-27
RCE via Print function [Simplenote 1.1.3 - Desktop app]
Automattic Code Injection (CWE-94)
High
2018-07-26
svcardproxydevus.starbucks.com Subdomain take over
Starbucks Improper Access Control - Generic (CWE-284)
High
2018-07-23
Able to purchase a gift card with any amount
Starbucks Insecure Direct Object Reference (IDOR) (CWE-639)
High
2018-07-20
[ponse] Path traversal in ponse module allows to read any file on server
Node.js third-party modules Path Traversal (CWE-22)
High
2018-07-20
Stored XSS in Node-Red
Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)
High
2018-07-18
[entitlements] Command injection on the 'path' parameter
Node.js third-party modules Command Injection - Generic (CWE-77)
High
2018-07-18
XSS (Persistent) - Selecting role(s) for protected branches
GitLab Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2018-10379
High
2018-07-16
Stored XSS in "post last edited" option
Discourse Cross-site Scripting (XSS) - Stored (CWE-79)
High
2018-07-09
De-anonymization by visiting specially crafted bookmark.
Tor Information Disclosure (CWE-200)
High
2018-07-03
Получение чужого номера телефона (все цифры) через форму восстановления пароля
VK.com Privacy Violation (CWE-359)
High
2018-06-30
Privilage escalation with malicious .npmrc
Node.js third-party modules Privilege Escalation (CAPEC-233)
High
2018-06-30
Insecure implementation of deserialization in cryo
Node.js third-party modules Code Injection (CWE-94)CVE-2018-3784
High
2018-06-19
Format String Vulnerability in the EdgeSwitch restricted CLI
Ubiquiti Inc. Use of Externally-Controlled Format String (CWE-134)
High
2018-06-19
Code Execution in restricted CLI of EdgeSwitch
Ubiquiti Inc. Command Injection - Generic (CWE-77)
High
2018-06-19
Authenticated RCE in ToughSwitch
Ubiquiti Inc. OS Command Injection (CWE-78)
High
2018-06-19
Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300
Ubiquiti Inc. Command Injection - Generic (CWE-77)
High
2018-06-19
Просмотр любых записей на стене
VK.com Information Disclosure (CWE-200)
High
2018-06-18
npm packages that overlap with core node packages
Node.js third-party modules Phishing (CAPEC-98)
High
2018-06-16
Insecure implementation of deserialization in funcster
Node.js third-party modules Code Injection (CWE-94)
High
2018-06-15
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609 $1,500
Nextcloud583—
Shopify464—
curl455—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—