目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1310 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,250
关联 CVE
1,864
参与项目数
343
近 7 天新增
6
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Phishing user to download malicious app could lead to leakage of User Access Token, Email, Name and Profile photo via exported RemoteService
Eternal Information Disclosure (CWE-200)
Low
2018-09-11
Open port leads to information disclosure
Weblate Information Disclosure (CWE-200)
Low
2018-09-10
Participation of expired account holders in Projects can occure financial loss to Mavenlink
Mavenlink Insecure Direct Object Reference (IDOR) (CWE-639)
Low
2018-09-09
IDOR to delete images from other stores
Eternal Insecure Direct Object Reference (IDOR) (CWE-639)
Low
2018-09-05
Stored XSS on Add Calendar
Concrete CMS Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2018-09-01
Stored XSS on Add Event in Calendar
Concrete CMS Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2018-09-01
Insecure Account Removal #2
Weblate Violation of Secure Design Principles (CWE-657)
Low
2018-08-28
Clickjacking In jobs.wordpress.net
WordPress UI Redressing (Clickjacking) (CAPEC-103)
Low
2018-08-22
Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties
HackerOne Information Disclosure (CWE-200)
Low
2018-08-17
Post Based XSS On Upload Via CK Editor [semrush.com]
Semrush Cross-site Scripting (XSS) - Reflected (CWE-79)
Low
2018-08-17
Password reset token leakage via referer
Semrush Violation of Secure Design Principles (CWE-657)
Low
2018-08-14
Basic auth details is still work on report ( 351555 )
Reverb.com Information Disclosure (CWE-200)
Low
2018-08-09
TeamProfile exposes partially sensitive information through GraphQL
HackerOne Information Disclosure (CWE-200)
Low
2018-08-08
CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception)
Discourse Cross-Site Request Forgery (CSRF) (CWE-352)
Low
2018-08-08
OPEN REDIRECTION at every 302 HTTP CODE
Brave Software Open Redirect (CWE-601)
Low
2018-08-07
Trusted daemon check fails when proxied through torsocks or proxychains
Monero Privacy Violation (CWE-359)
Low
2018-08-02
epee will accept an arbitrary amount of leading line-breaks in an http request
Monero Uncontrolled Resource Consumption (CWE-400)
Low
2018-08-02
HTML Injection inside Slack promotional emails
Slack
Low
2018-07-30
[FG-VD-17-063] NextCloud Insufficient Attack Protection Vulnerability Notification
Nextcloud Code Injection (CWE-94)CVE-2018-3776
Low
2018-07-29
HTML TAG INJECTION ON PROFILE NAME
GitLab Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2018-07-27
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify464—
curl459—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—