漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 1,447 份 · 本页赏金 $8,500 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Information disclousure by clicking on the link shown in http://████████/U.S. Dept Of Defense · 信息泄露 · 2019-12-02无赏金中危
- Disclosure of `payment_transactions` for programs via GraphQL queryHackerOne · 信息泄露 · 2019-12-01无赏金低危
- Internal IP Address DisclosedU.S. Dept Of Defense · 信息泄露 · 2020-05-14无赏金低危
- Origin IP found, Cloudflare bypassedPeople Interactive · 信息泄露 · 2023-07-27无赏金未评级
- Information disclosure with sensitive dataMail.ru · 信息泄露 · #703600$1,500未评级
- Information Disclosure [ https://curious.ru/api/submissions ]Mail.ru · 信息泄露 · #703086无赏金未评级
- Accessible Druid Monitor console on https://api.pay-staging.razer.com/Razer · 信息泄露 · #702784$1,500未评级
- Exposing debug.log file leads to server full path disclosureNextcloud · 信息泄露 · 2019-10-17无赏金低危
- "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statisticsHackerOne · 信息泄露 · 2020-02-21$500低危
- WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED)Nextcloud · 信息泄露 · 2019-11-11无赏金低危
- PII leakage due to scrceenshot of health recordsU.S. Dept Of Defense · 信息泄露 · 2019-12-02无赏金高危
- [expressjs-ip-control] Whitelist IP bypass leads to authorization bypass and sensitive info disclosureNode.js third-party modules · 信息泄露 · 2020-10-29无赏金低危
- Disclosure of Email title report in quick award paypout email (no content mode)HackerOne · 信息泄露 · 2019-10-11$500低危
- .git file accessibleBlockDev Sp. Z o.o · 信息泄露 · 2019-09-13无赏金低危
- Searching from Hacktivity returns hits for words in limited disclosure reports that are not visibleHackerOne · 信息泄露 · 2019-11-08无赏金低危
- Local File Disclosure on the ████████ (https://████/) leads to the source code disclosure & DB credentials leakU.S. Dept Of Defense · 信息泄露 · 2021-01-12无赏金中危
- Wordpress users disclosure on blog.makerdao.conBlockDev Sp. Z o.o · 信息泄露 · 2020-01-15无赏金低危
- Github information leakedSemrush · 信息泄露 · 2019-09-25无赏金中危
- Total Paid Bounty Paid can be discloseHackerOne · 信息泄露 · 2020-02-28$500低危
- Stealing the ip addres from usersVanilla · 信息泄露 · #672499无赏金未评级
- Bash History file logMail.ru · 信息泄露 · #671939无赏金未评级
- SSRF via Office file thumbnailsSlack · 信息泄露 · 2022-07-05$4,000高危
- Disclosure of Program email Title Report when being removed as contributor. Bypass for Report #645264HackerOne · 信息泄露 · 2019-09-06无赏金低危
- Username EnumerationNextcloud · 信息泄露 · 2019-11-11无赏金低危
- Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.govGSA Bounty · 信息泄露 · 2019-08-06无赏金低危