漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 772 份 · 本页赏金 $16,900 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- After the upload of an private file, using transformations, the file becomes public without the possibility of changing it.Mozilla · 访问控制 · 2023-10-20$1,000低危
- fs module's file watching is not restricted by --allow-fs-readNode.js · 访问控制 · 2023-07-20 · CVE-2023-30582无赏金低危
- fs.openAsBlob() bypasses permission systemNode.js · 访问控制 · 2023-07-20 · CVE-2023-30583无赏金低危
- Huge amount of Subdomains Takeovers at Reddit.comReddit · 访问控制 · 2023-05-18无赏金低危
- Text does not respect 'Allow download' permissionsNextcloud · 访问控制 · 2023-08-23 · CVE-2023-39961$250低危
- Subdomain takeover http://accessday.opn.ooo/Omise · 访问控制 · 2023-06-11$50低危
- Process-based permissions can be bypassed with the "inspector" module.Node.js · 访问控制 · 2023-07-20 · CVE-2023-30587无赏金中危
- Rider can forcefully get passenger's order accepted resulting in multiple impacts including PII reveal and more mentioned in the report.inDrive · 访问控制 · 2023-06-28无赏金中危
- ' Full Account Takeover ' at █████Mars · 访问控制 · 2023-06-23无赏金高危
- Banned user still able to invited to reports as a collabrator and reset the passwordHackerOne · 访问控制 · 2023-07-06无赏金低危
- Improper Access Control allows OTP bypassLark Technologies · 访问控制 · 2023-10-25无赏金低危
- Missing permission check when removing a photo from an albumNextcloud · 访问控制 · 2024-07-14 · CVE-2024-37314无赏金低危
- Cache purge requests are not authenticatedFastly VDP · 访问控制 · 2023-05-01无赏金低危
- LDAP Server NULL Bind Connection Information DisclosureU.S. Dept Of Defense · 访问控制 · 2023-05-15无赏金中危
- IBM Maximo Asset Management could allow a remote attacker to bypass authentication due to improper access controlsIBM · 访问控制 · 2024-02-06 · CVE-2023-32333无赏金低危
- Access to the business emails of Rockstar Support agents through the support platformRockstar Games · 访问控制 · 2025-10-02$550低危
- Any one can view collaborater email address via path /reports/<id>/participantsHackerOne · 访问控制 · 2023-06-01无赏金低危
- End-to-end encrypted file-drops can be made inaccessibleNextcloud · 访问控制 · 2023-06-22 · CVE-2023-35173$400中危
- Unauthenticated cache purgingFastly VDP · 访问控制 · 2023-05-01无赏金低危
- Improper Access Control + Financial fraud allows attacker to disclose + add arbitrary products to another's user's orderShipt · 访问控制 · #1903322$3,900未评级
- Authentication bypass on gist.github.com through SSH CertificatesGitHub · 访问控制 · 2023-04-20 · CVE-2023-23761$10,000中危
- 1 Click to 'Close Account and Refund' via POSTMESSAGETikTok · 访问控制 · 2024-01-03无赏金低危
- Users can set up workflows using restricted and invisible system tagsNextcloud · 访问控制 · 2023-05-17 · CVE-2023-30539无赏金低危
- Users can access exams in course without having to subscribe to PREMIUMLinkedIn · 访问控制 · 2024-01-10无赏金低危
- Reset password link sent over unsecured http protocolMattermost · 访问控制 · 2023-05-10$750中危