漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 1,447 份 · 本页赏金 $10,500 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Email enumeration at SignUp pageOmise · 信息泄露 · 2019-09-04无赏金低危
- [sso.33slona.ru] Application Messages Error stacktrace PHP.Mail.ru · 信息泄露 · #666065无赏金未评级
- [Brave browser] WebTorrent has DNS rebinding vulnerabilityBrave Software · 信息泄露 · 2019-10-16无赏金低危
- Access to multiple production Grafana dashboardsSnapchat · 信息泄露 · 2020-11-04$10,000中危
- Image Injection Vulnerability on /bully/screensRockstar Games · 信息泄露 · 2020-06-24无赏金低危
- Image Injection on `/bully/anniversaryedition` may lead to FB's OAuth Token Theft.Rockstar Games · 信息泄露 · 2020-06-24无赏金低危
- China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API EndpointStarbucks · 信息泄露 · 2020-04-01无赏金高危
- Image Injection vulnerability on screenshot-viewer/responsive/image may allow Facebook OAuth token theft.Rockstar Games · 信息泄露 · 2020-06-24无赏金低危
- Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve statusHackerOne · 信息泄露 · 2019-09-29$500低危
- Stored credentials instantly autofilled within sandboxed iframesKaspersky · 信息泄露 · 2019-09-10无赏金低危
- Private information exposed through GraphQL filtersHackerOne · 信息泄露 · 2019-07-23无赏金低危
- Program Email Nofication settings ignored when being added as an external contributorHackerOne · 信息泄露 · 2019-08-07无赏金低危
- Developper's websites are easily accessibles leading to massive information disclosureRadancy · 信息泄露 · #643882无赏金未评级
- Option method enabled in kartpay WebserversKartpay · 信息泄露 · 2019-08-28无赏金低危
- SMTP Failure Leads to Chain of Internal System FailureKartpay · 信息泄露 · 2019-08-28无赏金中危
- Total bounties paid amount is disclosed because of redesign of the Program ProfilesHackerOne · 信息泄露 · 2019-08-02无赏金低危
- Libcurl ocasionally sends HTTPS traffic to port 443 rather than specified port 8080curl · 信息泄露 · 2021-02-03无赏金低危
- Project Milestones Disclosed Via Groups When the Victim disabled milestones access in project settingsGitLab · 信息泄露 · 2019-12-13 · CVE-2019-15577无赏金低危
- HTML injection and information disclosure in support panelWeblate · 信息泄露 · 2019-07-09无赏金低危
- Private System Note Disclosure using GraphQLGitLab · 信息泄露 · 2019-12-13 · CVE-2019-15576无赏金低危
- Information disclosure on sim.starbucks.comStarbucks · 信息泄露 · 2019-11-13 · CVE-2019-3403无赏金低危
- Listing of Amazon S3 Bucket accessible to any amazon authenticated user (vector-maps-e457472599)TomTom · 信息泄露 · #631529无赏金未评级
- Public Github Repo Leaking Internal Credentials Leading To DiscoveryIQ Docker AccessInformatica · 信息泄露 · 2019-08-06无赏金高危
- User personal data disclosure via APIVercel · 信息泄露 · #630235无赏金未评级
- Lack of CSRF header validation at https://g-mail.grammarly.com/profileSuperhuman (formerly Grammarly) · 信息泄露 · 2019-10-31无赏金低危