漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 1,396 份 · 本页赏金 $12,450 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Unauthenticated IP allowlist bypass when accessing job artifacts through gitlab pages at `{group_id}.gitlab.io`GitLab · 访问控制 · 2022-09-22无赏金低危
- Deprecated owners.query API bypasses object view policyPhabricator · 访问控制 · 2022-05-31$300未评级
- unauth mosquitto ( client emails, ips, license keys exposure )Acronis · 访问控制 · 2022-07-18$150低危
- Banned user still has access to their deleted account via HackerOne's API using their API keyHackerOne · 访问控制 · 2025-07-14无赏金低危
- Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings]LinkedIn · 访问控制 · 2022-08-26无赏金低危
- One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.comReddit · 访问控制 · 2022-08-02无赏金高危
- error parse uri path in curlcurl · 访问控制 · 2022-05-13无赏金中危
- Global default settings page is accessible to non-administratorsPhabricator · 访问控制 · 2022-05-09$300未评级
- Privilege escalation possible in dovecot when similar passdbs are usedOpen-Xchange · 访问控制 · #1561579$900未评级
- Possible to make restricted files public on Phabricator via DiffusionPhabricator · 访问控制 · 2022-07-29$2,000未评级
- Tomcat Servlet Examples accessible at https://44.240.33.83:38443 and https://52.36.56.155:38443Stripe · 访问控制 · 2022-10-19无赏金低危
- Exposure of Private Personal Information to an Unauthorized Actor - PII and soldier data (mos, schools, and speciality training)U.S. Dept Of Defense · 访问控制 · 2025-01-24无赏金高危
- Collaborators and Staff members without all necessary permissions are able to create, edit and install custom appsShopify · 访问控制 · 2022-07-11$1,900低危
- Able to bypass email verification and change email to any other user emailReddit · 访问控制 · 2022-05-06$5,000中危
- Staff without Manage Themes permissions can update themesShopify · 访问控制 · 2024-01-23无赏金低危
- Unauthorized packages modification or secrets exfiltration via GitHub actionsLinux Foundation Decentralized Trust · 访问控制 · 2022-07-08$1,500中危
- Unauthorized Access to Internal Server Panel without AuthenticationU.S. Dept Of Defense · 访问控制 · 2022-06-27无赏金低危
- Anonymous access control - Payments StatusOmise · 访问控制 · 2022-08-07$100低危
- subdomain takeover at odoo-staging.exness.ioEXNESS · 访问控制 · 2022-07-18无赏金低危
- Read-only administrator can change agent update settingsAcronis · 访问控制 · 2022-08-10$200低危
- Ticket Trick Attack allows access to ████████' workspacesRockstar Games · 访问控制 · 2026-09-01无赏金中危
- Ability to View Non-Permitted Admin LogLark Technologies · 访问控制 · 2022-10-20无赏金低危
- Found Origin IP's Lead To Access To kraden.comKraden · 访问控制 · #1531183$100未评级
- Github Account Takeover which is used as gradle vcs in "github.com/palantir/gradle-launch-config-plugin"Palantir Public · 访问控制 · 2022-05-05无赏金低危
- A malicious actor could rotate tokens of a victim, given that he knows the victim's token IDCloudflare Public Bug Bounty · 访问控制 · 2023-04-13无赏金中危