漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 1,396 份 · 本页赏金 $1,400 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Unauthorized updates to extended_info properties in /store/ajaxpackagesaveValve · 访问控制 · 2020-09-09无赏金中危
- Subdomain takeover at iosota.razersynapse.com via Amazon S3Razer · 访问控制 · #813313$200未评级
- Access control on https://eaccounting.stage.vismaonline.com/Visma Public · 访问控制 · #812143$100未评级
- Read-only user can delete higher privileged members using open DELETE /api/memberships/<membershipID> endpointHelium · 访问控制 · 2020-06-29无赏金低危
- Organization TakeoverHelium · 访问控制 · 2020-05-27$500中危
- No ACL on S3 Bucket in [https://www.██████████/]U.S. Dept Of Defense · 访问控制 · 2020-05-14无赏金低危
- [v7lk.relap.io] Sending arbitrary emails to any userMail.ru · 访问控制 · #808730无赏金未评级
- SharePoint Web Services Exposed to Anonymous Access UsersU.S. Dept Of Defense · 访问控制 · 2020-07-14无赏金低危
- A non-administrator user can change his email even when it is restricted by an administratorVisma Public · 访问控制 · #805943$250未评级
- Sensitive information of helpdesk is being leaked.Lark Technologies · 访问控制 · 2021-03-06无赏金低危
- [█████████] Administrative access to Oracle WebLogic Server using default credentialsU.S. Dept Of Defense · 访问控制 · 2020-06-25无赏金高危
- Access to private file's of helpdesk.Lark Technologies · 访问控制 · 2022-10-18无赏金低危
- Reduced Payment amount while paying on Crypto CurrenciesNord Security · 访问控制 · #803876无赏金未评级
- Grafana Improper authorizationKubernetes · 访问控制 · 2020-10-31无赏金低危
- [Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · 访问控制 · 2020-04-01无赏金高危
- Cross Origin Resource Sharing Misconfiguration | Lead to sensitive informationNord Security · 访问控制 · #796557无赏金未评级
- [Critical] Insufficient Access Control On Registration Page of Webapps Website Allows Privilege Escalation to AdministratorU.S. Dept Of Defense · 访问控制 · 2020-05-27无赏金高危
- Users Without Permission Can Download Restricted FilesLark Technologies · 访问控制 · 2022-10-18无赏金低危
- Email address of any user can be queried on Report Invitation GraphQL type when username is knownHackerOne · 访问控制 · 2020-02-20无赏金中危
- Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOShopify · 访问控制 · 2020-04-01无赏金高危
- Members from parent group keep their access level on a subgroup transfer and are invisibleGitLab · 访问控制 · 2020-09-08无赏金中危
- A 'Read only' user can modify the company logotype and invoice background imageVisma Public · 访问控制 · #790528$100未评级
- Secure credentials values disclosure to regular users due to access control issue in monitor creating functionNew Relic · 访问控制 · #788499无赏金未评级
- "Secure View" aka "Hide Download" can be bypassed easilyNextcloud · 访问控制 · 2020-04-10 · CVE-2020-8139无赏金中危
- AWS subdomain Takeover at estore.razersynapse.comRazer · 访问控制 · #785179$250未评级