漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 1,396 份 · 本页赏金 $21,250 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Banned user still able to invited to reports as a collabrator and reset the passwordHackerOne · 访问控制 · 2023-07-06无赏金低危
- OpenSSL engines can be used to bypass and/or disable the permission modelNode.js · 访问控制 · 2023-06-22 · CVE-2023-30586无赏金低危
- Improper Access Control allows OTP bypassLark Technologies · 访问控制 · 2023-10-25无赏金低危
- Missing permission check when removing a photo from an albumNextcloud · 访问控制 · 2024-07-14 · CVE-2024-37314无赏金低危
- Cache purge requests are not authenticatedFastly VDP · 访问控制 · 2023-05-01无赏金低危
- LDAP Server NULL Bind Connection Information DisclosureU.S. Dept Of Defense · 访问控制 · 2023-05-15无赏金中危
- IBM Maximo Asset Management could allow a remote attacker to bypass authentication due to improper access controlsIBM · 访问控制 · 2024-02-06 · CVE-2023-32333无赏金低危
- Access to the business emails of Rockstar Support agents through the support platformRockstar Games · 访问控制 · 2025-10-02$550低危
- Any one can view collaborater email address via path /reports/<id>/participantsHackerOne · 访问控制 · 2023-06-01无赏金低危
- End-to-end encrypted file-drops can be made inaccessibleNextcloud · 访问控制 · 2023-06-22 · CVE-2023-35173$400中危
- Unauthenticated cache purgingFastly VDP · 访问控制 · 2023-05-01无赏金低危
- Improper Access Control + Financial fraud allows attacker to disclose + add arbitrary products to another's user's orderShipt · 访问控制 · #1903322$3,900未评级
- Authentication bypass on gist.github.com through SSH CertificatesGitHub · 访问控制 · 2023-04-20 · CVE-2023-23761$10,000中危
- 1 Click to 'Close Account and Refund' via POSTMESSAGETikTok · 访问控制 · 2024-01-03无赏金低危
- Users can set up workflows using restricted and invisible system tagsNextcloud · 访问控制 · 2023-05-17 · CVE-2023-30539无赏金低危
- Users can access exams in course without having to subscribe to PREMIUMLinkedIn · 访问控制 · 2024-01-10无赏金低危
- Reset password link sent over unsecured http protocolMattermost · 访问控制 · 2023-05-10$750中危
- Nextcloud mail does not respect download permissions in sharesNextcloud · 访问控制 · 2024-12-15 · CVE-2024-52509$250低危
- The use of __proto__ in process.mainModule.__proto__.require() bypasses the permission system in Node v19.6.1Node.js · 访问控制 · 2023-07-20 · CVE-2023-30581无赏金中危
- Privilege Esacalation at Apache Airflow 2.5.1Internet Bug Bounty · 访问控制 · 2023-05-18 · CVE-2023-25754$2,400低危
- LDAP anonymous access enabled at certrep.pki.state.gov:389U.S. Department of State · 访问控制 · 2023-05-11无赏金低危
- Scope information is leaked when visiting policy scopes tab of any External ProgramHackerOne · 访问控制 · 2023-03-10无赏金低危
- Stealing Users OAuth authorization code via redirect_uripixiv · 访问控制 · 2023-03-22$2,000中危
- inDriver Job - Admin Approval BypassinDrive · 访问控制 · 2023-07-05$1,000低危
- Bug Report #23JAN136 (subdomain takeover via shopify )Mars · 访问控制 · 2025-09-02无赏金中危