漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 607 份 · 本页赏金 $21,750 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- Recently added 'Country' field doesn't send email notification when changedHackerOne · 错误配置 · 2020-08-25无赏金低危
- Pentester can obtain information about other pentesters who applied for the same test, but weren't acceptedHackerOne · 信息泄露 · 2020-08-24$500低危
- Graphql: Sorting the reports by jira_status field resulted to different valueHackerOne · 访问控制 · 2020-08-27无赏金低危
- Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS.HackerOne · 信息泄露 · 2020-10-02无赏金低危
- SAML Response Reuse on hackerone.com/users/saml/authHackerOne · 身份认证 · 2020-07-24无赏金低危
- Uploading large payload on domain instructions causes server-side DoSHackerOne · 拒绝服务 · 2020-06-20$2,500低危
- Near to Infinite loop when changing Group's name that has API token as Team MemberHackerOne · 信息泄露 · 2020-07-23$2,500低危
- GraphQL field on Team node can be used to determine if External Program runs invite-only programHackerOne · 信息泄露 · 2020-07-25$2,500低危
- Unauthorized access to metadata of undisclosed reports that were retestedHackerOne · 信息泄露 · 2020-06-05无赏金低危
- Disclosure of the name of a program that has a private part with an external linkHackerOne · 信息泄露 · 2020-05-22$500低危
- The hacker has access to the administrative part of the management reports in publish reportHackerOne · 其他弱点 · 2020-12-16$500低危
- Subdomain takeover of resources.hackerone.comHackerOne · 错误配置 · 2020-05-15$500低危
- Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted requestHackerOne · 拒绝服务 · 2020-05-25无赏金低危
- Potential stored Cross-Site Scripting vulnerability in Support BackendHackerOne · 跨站脚本 · 2020-05-04无赏金低危
- Reflected XSS on www.hackerone.com and resources.hackerone.comHackerOne · 跨站脚本 · 2020-05-05$500低危
- Login CSRF vulnerability on hackerone.comHackerOne · 跨站请求伪造 · 2020-06-12$500低危
- program_analytics_benchmarks query shows information not visible in publicHackerOne · 信息泄露 · 2020-03-27无赏金低危
- Attacker may be able to bounce enough emails which suspend HackerOne's SES service and cause a DoS of HackerOne's email serviceHackerOne · 拒绝服务 · 2020-06-12无赏金低危
- Read-only team members can read all properties of webhooksHackerOne · 访问控制 · 2020-04-29无赏金低危
- A team member of the program with Report rights can ban the AdminHackerOne · 业务逻辑 · 2020-05-15无赏金低危
- Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsHackerOne · 错误配置 · 2024-02-04$3,750低危
- Changes to data in a CVE request after draft via GraphQL queryHackerOne · 业务逻辑 · 2020-05-15无赏金低危
- Rounding errors on rewarding a bounty leads to bypassing the 20% H1 commission feeHackerOne · 业务逻辑 · 2020-05-15无赏金低危
- Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spamHackerOne · 业务逻辑 · 2020-05-15无赏金低危
- Customer private program can disclose email any users through invited via usernameHackerOne · 信息泄露 · 2020-05-15$7,500中危