漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 463 份 · 本页赏金 $2,366 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Password Reset Link Leaked In Refer Header In Request To Third Party SitesNord Security · 密码学缺陷 · #751581无赏金未评级
- Remotely trigger an assertion on a TLS server with a malformed certificate stringNode.js · 密码学缺陷 · 2020-02-06 · CVE-2019-15604无赏金高危
- Dragonblood: Design and Implementation Flaws in WPA3 and EAP-pwdInternet Bug Bounty · 密码学缺陷 · 2020-05-05 · CVE-2019-11234无赏金低危
- Downgrade encryption scheme and break integrity through known-plaintext attackNextcloud · 密码学缺陷 · 2020-11-05 · CVE-2020-8150无赏金低危
- Able to change password by entering wrong old passwordStripo Inc · 密码学缺陷 · 2019-12-18无赏金未评级
- [HTAF4-213] [Pre-submission] CVE-2018-2879 (padding oracle attack in the Oracle Access Manager) at https://█████████U.S. Dept Of Defense · 密码学缺陷 · 2021-07-29 · CVE-2018-2879无赏金中危
- curl successfully matches IP address literal in URL against IP address literal in certificate Common Namecurl · 密码学缺陷 · 2021-01-08 · CVE-2019-14553无赏金未评级
- Only OpenSSL handles a CRL when passed in via CApathcurl · 密码学缺陷 · 2021-01-08无赏金中危
- SSO through odnoklassniki uses http rather than httpsBumble · 密码学缺陷 · 2019-12-21$150低危
- Mixed content issues on newrelic.comNew Relic · 密码学缺陷 · #700091无赏金未评级
- [crypto-js] Insecure entropy source - Math.random()Node.js third-party modules · 密码学缺陷 · 2020-06-04无赏金低危
- Link obfuscation bugBrave Software · 密码学缺陷 · 2019-08-12无赏金低危
- Yarn transfers npm credentials over unencrypted http connectionNode.js third-party modules · 密码学缺陷 · 2019-08-14 · CVE-2019-5448无赏金中危
- Ubuntu/Debian installation method allows key poisoning and code execution for network attackerMariaDB · 密码学缺陷 · 2020-01-21无赏金低危
- Fedora installation instructions fetch repo and validation key from insecure source, allowing mitm attackDropbox · 密码学缺陷 · #638250$216未评级
- Industry-Wide MITM Vulnerability Impacting the JVM EcosystemInternet Bug Bounty · 密码学缺陷 · 2019-09-10无赏金中危
- Testnet address being sent in cleartext as http://rinkeby.chain.link/ is missing SSL certificateChainlink · 密码学缺陷 · 2019-07-17无赏金低危
- Insufficient DKIM record with RSA 512-bit key used on WordPress.comAutomattic · 密码学缺陷 · 2019-05-30无赏金低危
- [https-proxy-agent] Socket returned without TLS upgrade on non-200 CONNECT response, allowing request data to be sent over unencrypted connectionNode.js third-party modules · 密码学缺陷 · 2019-09-25无赏金低危
- "Test target" of the "HTTP target" extension can unintentionally send username and password in the Authorization headerZendesk · 密码学缺陷 · #536669无赏金未评级
- Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijackSlack · 密码学缺陷 · 2020-03-12$2,000中危
- Catch mails sent to an SMTP Server over SSL using an Evil SMTP ServerUbiquiti Inc. · 密码学缺陷 · 2019-08-22 · CVE-2019-5456无赏金中危
- smtp service vulnerable to POODLE SSLv3MariaDB · 密码学缺陷 · 2019-05-11 · CVE-2014-3566无赏金低危
- Missing DNSSECNextcloud · 密码学缺陷 · 2019-08-29无赏金低危
- `Cody trolled us all` h1-702 CTF write-up50m-ctf · 密码学缺陷 · #507148无赏金未评级