目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,219
关联 CVE
1,854
参与项目数
342
近 7 天新增
7
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：kaspersky✕
No Rate Limit On Forgot Password Page
Kaspersky Improper Access Control - Generic (CWE-284)
Low
2021-05-24
Several domains on kaspersky.com are vulnerable to Web Cache Deception attack
Kaspersky Insecure Storage of Sensitive Information (CWE-922)
Medium
2021-05-20
[Fixed] KIS for macOS is vulnerable to AV bypass due to improper client authorization on XPC service
Kaspersky Improper Access Control - Generic (CWE-284)CVE-2021-26718
Medium
2021-04-01
[Fixed] A vulnerability in KAVKIS 2020 products family allows full disabling of protection
Kaspersky Code Injection (CWE-94)
High
2021-03-31
Kaspersky Protection extension for Google Chrome is vulnerable to abuse its features
Kaspersky Command Injection - Generic (CWE-77)CVE-2019-15684
Medium
2019-11-25
Web protection component in Anti-Virus products family uses predictable links for certificate warnings
Kaspersky Insecure Direct Object Reference (IDOR) (CWE-639)CVE-2019-15688
Medium
2019-11-25
Kaspersky Password Manager allows websites to access user's address data
Kaspersky Information Disclosure (CWE-200)
Medium
2019-11-24
Unauthorized command execution in Web protection component of Anti-Virus products family [FF, Chrome]
Kaspersky Command Injection - Generic (CWE-77)CVE-2019-15685
Medium
2019-11-24
Unauthorized command execution in Web protection component of Anti-Virus products family
Kaspersky Command Injection - Generic (CWE-77)CVE-2019-15685
Medium
2019-11-24
Unauthorized command execution in Web protection component of Anti-Virus products family [IE]
Kaspersky Command Injection - Generic (CWE-77)CVE-2019-15685
Medium
2019-11-24
Stored credentials instantly autofilled within sandboxed iframes
Kaspersky Information Disclosure (CWE-200)
Low
2019-09-10
Web protection component in Anti-Virus products family ignores HSTS security policy
Kaspersky Man-in-the-Middle (CWE-300)
Medium
2019-09-05
Certificate warnings and similar UI elements in Web protection of Anti-Virus products family are susceptible to clickjacking
Kaspersky UI Redressing (Clickjacking) (CAPEC-103)
Medium
2019-08-28
URL Advisor component in KIS products family is vulnerable to Universal XSS
Kaspersky Cross-site Scripting (XSS) - Generic (CWE-79)
High
2019-08-28
Kaspersky Password Manager is vulnerable to HTML injection in the browser action pop-up via user name
Kaspersky Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2018-12-24
test report
Kaspersky Heap Overflow (CWE-122)
Medium
2018-08-15
Hard Coded username and password in registry
Kaspersky Use of Hard-coded Credentials (CWE-798)
None
2018-05-06
Keys
Kaspersky Information Disclosure (CWE-200)
Low
2018-02-02
In App purchase Hack
Kaspersky Use of a Key Past its Expiration Date (CWE-324)
Critical
2017-08-03
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895