漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 772 份 · 本页赏金 $12,450 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Found Origin IP's lead to access to gitlabGitLab · 访问控制 · 2022-08-02无赏金低危
- DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)Node.js · 访问控制 · 2022-09-28 · CVE-2018-7160无赏金中危
- Broken access discloses users and PII at https://███████ [HtUS]U.S. Dept Of Defense · 访问控制 · 2022-10-14无赏金中危
- Enable 2Fa verification without verifying emailCloudflare Public Bug Bounty · 访问控制 · 2022-08-31无赏金低危
- Any expired reset password link can still be used to reset the passwordAcronis · 访问控制 · 2022-09-01$100低危
- Improper Access Control in Ali Express ImporterJudge.me · 访问控制 · 2023-02-01无赏金低危
- Admin can create a hidden admin account which even the owner can not detect and remove and do administrative actions on the application.Reddit · 访问控制 · 2022-11-14无赏金中危
- Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicateNextcloud · 访问控制 · 2022-12-25 · CVE-2022-4192无赏金低危
- Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io`GitLab · 访问控制 · 2022-09-22无赏金低危
- Deprecated owners.query API bypasses object view policyPhabricator · 访问控制 · 2022-05-31$300未评级
- unauth mosquitto ( client emails, ips, license keys exposure )Acronis · 访问控制 · 2022-07-18$150低危
- Banned user still has access to their deleted account via HackerOne's API using their API keyHackerOne · 访问控制 · 2025-07-14无赏金低危
- One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comReddit · 访问控制 · 2022-08-02无赏金高危
- error parse uri path in curlcurl · 访问控制 · 2022-05-13无赏金中危
- Global default settings page is accessible to non-administratorsPhabricator · 访问控制 · 2022-05-09$300未评级
- Privilege escalation possible in dovecot when similar passdbs are usedOpen-Xchange · 访问控制 · #1561579$900未评级
- Possible to make restricted files public on Phabricator via DiffusionPhabricator · 访问控制 · 2022-07-29$2,000未评级
- Collaborators and Staff members without all necessary permissions are able to create, edit and install custom appsShopify · 访问控制 · 2022-07-11$1,900低危
- Able to bypass email verification and change email to any other user emailReddit · 访问控制 · 2022-05-06$5,000中危
- Unauthorized packages modification or secrets exfiltration via GitHub actionsLinux Foundation Decentralized Trust · 访问控制 · 2022-07-08$1,500中危
- Unauthorized Access to Internal Server Panel without AuthenticationU.S. Dept Of Defense · 访问控制 · 2022-06-27无赏金低危
- Anonymous access control - Payments StatusOmise · 访问控制 · 2022-08-07$100低危
- Read-only administrator can change agent update settingsAcronis · 访问控制 · 2022-08-10$200低危
- Ticket Trick Attack allows access to ████████' workspacesRockstar Games · 访问控制 · 2026-09-01无赏金中危
- Ability to View Non-Permitted Admin LogLark Technologies · 访问控制 · 2022-10-20无赏金低危