漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 607 份 · 本页赏金 $8,000 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Markdown parsing issue enables insertion of malicious tags and event handlersHackerOne · 跨站脚本 · 2018-01-29$5,000中危
- Domain spoofing in redirect page using RTLOHackerOne · 开放重定向 · 2018-01-30无赏金低危
- HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse formsHackerOne · 其他弱点 · 2018-03-13无赏金低危
- Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestionHackerOne · 错误配置 · 2018-01-22$500低危
- Open redirect deceive in hackerone.com via another open redirect link.HackerOne · 开放重定向 · 2017-12-13无赏金低危
- Query parameter reordering causes redirect page to render unsafe URLHackerOne · 跨站脚本 · 2017-11-30$1,500低危
- Able To Check The Exact Bounty Balance of any Bug Bounty ProgramHackerOne · 信息泄露 · 2017-12-06无赏金低危
- Validation message in Bounty award endpoint can be used to determine program balancesHackerOne · 信息泄露 · 2017-11-29无赏金低危
- IDOR on Program Visibilty (Revealed / Concealed) against other team membersHackerOne · 不安全的直接对象引用 · 2017-11-23无赏金低危
- Introspection query leaks sensitive graphql system information.HackerOne · 信息泄露 · 2017-11-22无赏金未评级
- Information Disclosure when /invitations/<token>.json is not yet acceptedHackerOne · 信息泄露 · 2019-12-06无赏金低危
- Program profile metrics endpoint contains mean time to triage, even when turned offHackerOne · 信息泄露 · 2017-11-14无赏金低危
- Additional bypass allows SSRF for internal netblocksHackerOne · 服务端请求伪造 · 2017-11-16 · CVE-2017-0909无赏金未评级
- Blind SSRF in "Integrations" by abusing a bug in Ruby's native resolver.HackerOne · 服务端请求伪造 · 2017-11-09 · CVE-2017-0904无赏金未评级
- Reverse Tabnabbing Vulnerability in Outgoing LinksHackerOne · 其他弱点 · 2017-11-21无赏金低危
- GraphQL sessions aren't immediately invalidated when user password is changedHackerOne · 身份认证 · 2017-11-30无赏金未评级
- Private partial disclosure of h1 infrastructureHackerOne · 信息泄露 · 2017-11-03无赏金低危
- Private Program all members disclosedHackerOne · 信息泄露 · 2017-11-16无赏金未评级
- View Any Program's Team Members through GET https://hackerone.com/invitations/HackerOne · 信息泄露 · 2017-11-01$1,000低危
- Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query pageHackerOne · 信息泄露 · 2017-11-01无赏金低危
- Issue with password change in Disabled AccountHackerOne · 错误配置 · 2017-11-16无赏金低危
- Invalid Host detection at https://hackerone.com/redirectHackerOne · 开放重定向 · 2017-12-03无赏金低危
- Pending member invitations are not revoked on program name changeHackerOne · 信息泄露 · 2017-11-18无赏金低危
- Banned researcher gets email updates on a private program.HackerOne · 其他弱点 · 2019-05-18无赏金未评级
- Homograph fix BypassHackerOne · 业务逻辑 · 2017-10-16无赏金低危