漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,250

关联 CVE

1,864

参与项目数

343

近 7 天新增

6

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

Fix for self-DoS in Security-txt Chrome Extension.

Ed Uncontrolled Resource Consumption (CWE-400)

Low

2017-12-19

Cross-site scripting in "Contact customer" form

Shopify Cross-site Scripting (XSS) - Stored (CWE-79)

Low

2017-12-19

NET::Ftp allows command injection in filenames

Ruby Command Injection - Generic (CWE-77)CVE-2017-17405

Low

2017-12-19

Chrome Extension is vulnerable to the self-DOS issues in case it process the security.txt with a big size

Ed Uncontrolled Resource Consumption (CWE-400)

Low

2017-12-18

[marketplace.informatica.com] - Sensitive Data Exposure

Informatica Privacy Violation (CWE-359)

Low

2017-12-18

X-XSS-Protection -> Misconfiguration

U.S. Dept Of Defense Violation of Secure Design Principles (CWE-657)

Low

2017-12-15

Open redirect deceive in hackerone.com via another open redirect link.

HackerOne Open Redirect (CWE-601)

Low

2017-12-13

No Rate Limit on account deletion request(Leads to huge email flooding/email bombing)

Infogram Violation of Secure Design Principles (CWE-657)

Low

2017-12-12

Javascript Payload reflected Back in Report Embed Code

Infogram Cross-site Scripting (XSS) - Stored (CWE-79)

Low

2017-12-12

Content Security Policy not applied to error pages at multiple HackerOne endpoints

HackerOne Violation of Secure Design Principles (CWE-657)

Low

2017-12-12

Content Spoofing @ https://irclogs.wordpress.org/

WordPress Improper Access Control - Generic (CWE-284)

Low

2017-12-04

Invalid Host detection at https://hackerone.com/redirect

HackerOne Violation of Secure Design Principles (CWE-657)

Low

2017-12-03

Use any User to Follow you (Increase Followers) [IDOR]

Eternal Insecure Direct Object Reference (IDOR) (CWE-639)

Low

2017-11-28

Oauth flow on the comments widget login can lead to the access code leakage

Ed Improper Authentication - Generic (CWE-287)

Low

2017-11-24

Nginx version disclosure via forbidden page

Yelp Information Disclosure (CWE-200)

Low

2017-11-21

Issue with password change in Disabled Account

HackerOne Violation of Secure Design Principles (CWE-657)

Low

2017-11-16

Bypass insecure password validation

Low

2017-11-16

Self-XSS in password reset functionality

Shopify Cross-site Scripting (XSS) - Reflected (CWE-79)

Low

2017-11-10

Vulnerable exported broadcast receiver

Bitwarden Violation of Secure Design Principles (CWE-657)

Low

2017-11-10

Content spoofing on yelp.onelogin

Yelp Open Redirect (CWE-601)

Low

2017-11-09

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	$2,257
HackerOne	609	—
Nextcloud	584	—
Shopify	464	—
curl	459	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$7,000
Uber	239	—