漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告

12,244

关联 CVE

1,864

参与项目数

343

近 7 天新增

23

严重度: All Critical High Medium Low

类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

MailPoet Newsletters <= 2.7.2 - Authenticated Reflected Cross-Site Scripting (XSS)

Eternal Cross-site Scripting (XSS) - Generic (CWE-79)

High

2017-06-17

Completed Compromise & Source Code Disclosure via Exposed Jenkins Dashboard at https://jenkins101.udemy.com

Udemy Code Injection (CWE-94)

High

2017-06-17

Privilege escalation-User who does not have access is able to add notes to the contact

Mixmax Privilege Escalation (CAPEC-233)

High

2017-06-16

Parameter tampering can result in product price manipulation

High

2017-06-14

Clickjacking on Mixmax.com

Mixmax UI Redressing (Clickjacking) (CAPEC-103)

High

2017-06-13

Stored XSS templates -> 'call for action' feature

High

2017-06-09

null pointer dereference in Sass::Eval::operator()(Sass::Map*)

LibSass NULL Pointer Dereference (CWE-476)

High

2017-06-08

ci.nextcloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)

Nextcloud Uncontrolled Resource Consumption (CWE-400)CVE-2015-5477

High

2017-06-08

[compose.mixmax.com] Stored XSS on compose.mixmax.com in contact names.

Mixmax Cross-site Scripting (XSS) - Stored (CWE-79)

High

2017-06-06

Password Reset link hijacking via Host Header Poisoning

Concrete CMS Privilege Escalation (CAPEC-233)

High

2017-06-06

Uploaded XLF files result in External Entity Execution

Weblate XML External Entities (XXE) (CWE-611)

High

2017-06-02

XSS in $shop$.myshopify.com/admin/ via twine template injection in "Shopify.API.Modal.input" method when using a malicious app

Shopify Cross-site Scripting (XSS) - Generic (CWE-79)

High

2017-06-01

Information disclosure vulnerability on a DoD website

U.S. Dept Of Defense Information Disclosure (CWE-200)

High

2017-06-01

doc.owncloud.com: CVE-2015-5477 BIND9 TKEY Vulnerability + Exploit (Denial of Service)

ownCloud CVE-2015-5477

High

2017-06-01

Mixmax Cross-Site Request Forgery (CSRF) (CWE-352)

High

2017-06-01

SQL injection vulnerability on a DoD website

U.S. Dept Of Defense SQL Injection (CWE-89)

High

2017-05-31

Heap Overflow in fiber_switch triggered from Fiber.transfer

shopify-scripts Heap Overflow (CWE-122)

High

2017-05-30

[URGENT] Opportunity to publish tweets on any twitters account

High

2017-05-22

XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app

Shopify Cross-site Scripting (XSS) - Generic (CWE-79)

High

2017-05-22

[marketplace.informatica.com] Search XSS

Informatica Cross-site Scripting (XSS) - Generic (CWE-79)

High

2017-05-22

高频漏洞类型

最活跃项目

项目	报告数	最高赏金
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	$2,257
HackerOne	609	—
Nextcloud	583	—
Shopify	464	—
curl	457	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	—