目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All Critical High Medium Low
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
SSRF in graphQL query (pwapi.ex2b.com)
EXNESS Server-Side Request Forgery (SSRF) (CWE-918)
Medium
2023-07-24
Password reset endpoint is not brute force protected
Nextcloud Improper Restriction of Authentication Attempts (CWE-307) CVE-2023-35172
High
2023-07-21
DiffieHellman doesn't generate keys after setting a key
Node.js Inconsistency Between Implementation and Documented Design (CWE-1068) CVE-2023-30590
Medium
2023-07-20
node.js process aborts when processing x509 certs with invalid public key information
Node.js Uncontrolled Resource Consumption (CWE-400) CVE-2023-30588
Medium
2023-07-20
Process-based permissions can be bypassed with the "inspector" module.
Node.js Improper Access Control - Generic (CWE-284) CVE-2023-30587
High
2023-07-20
Filesystem experimental permissions policy does not handle path traversal cases.
Node.js Path Traversal (CWE-22) CVE-2023-30584
High
2023-07-20
fs.openAsBlob() bypasses permission system
Node.js Improper Access Control - Generic (CWE-284) CVE-2023-30583
Medium
2023-07-20
fs module's file watching is not restricted by --allow-fs-read
Node.js Improper Access Control - Generic (CWE-284) CVE-2023-30582
Medium
2023-07-20
The use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1
Node.js Privilege Escalation (CAPEC-233) CVE-2023-30581
High
2023-07-20
Ad Account Takeover
LinkedIn Privilege Escalation (CAPEC-233)
Critical
2023-07-20
[Hubs] - Broken access control in placing objects in hubs room
Mozilla Improper Access Control - Generic (CWE-284)
Medium
2023-07-20
Bypass for forced re-authentication upon biometrics change
Bitwarden Improper Authentication - Generic (CWE-287)
Medium
2023-07-19
heap-buffer-overflow in gc_writebarrier_incremental
Ruby Heap Overflow (CWE-122)
None
2023-07-19
RDoc::MethodAttr is vulnerable to Regular Expression Denial of Service (ReDoS)
Ruby Uncontrolled Resource Consumption (CWE-400)
Low
2023-07-18
Arbitrary file injection via symlink attack in rdoc generator
Ruby Resource Injection (CWE-99)
None
2023-07-18
XSS exploit of RDoc documentation generated by rdoc
Ruby Cross-site Scripting (XSS) - Stored (CWE-79) CVE-2013-0256
Medium
2023-07-18
XSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256)
Ruby Cross-site Scripting (XSS) - Stored (CWE-79) CVE-2013-0256
Medium
2023-07-18
Stored XSS in RDoc hyperlinks through javascript scheme
Ruby Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2023-07-18
XSS in HTML generated by RDoc
Ruby Cross-site Scripting (XSS) - Stored (CWE-79)
Unknown
2023-07-18
An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashier
Unikrn Insecure Direct Object Reference (IDOR) (CWE-639)
High
2023-07-17
高频漏洞类型
最活跃项目
项目 报告数 最高赏金
U.S. Dept Of Defense 896 —
Internet Bug Bounty 817 $2,257
HackerOne 609 —
Nextcloud 584 —
Shopify 465 —
curl 464 —
Node.js third-party modules 307 —
GitLab 258 —
X / xAI 250 —
Uber 239 —