信息泄露

数量第二多的类别。从堆栈信息到硬编码的密钥，很多更严重的漏洞都是从这里开始的。

影响

泄露凭据、个人信息或内部实现细节，为进一步攻击提供条件

观察点

响应或静态资源中包含了不应公开的数据

修复

关闭生产环境的调试输出，扫描并轮换泄露的密钥，最小化接口返回的字段。

弱点分布

• 信息泄露1,447
• Unlabeled145
• 隐私侵犯83
• 敏感信息明文存储74
• 敏感信息不安全存储55
• 违反安全设计原则（按标题归类）43
• 错误信息泄露41
• 目录列表泄露36
• 调试信息泄露35
• Information Exposure Through Sent Data30
• Insufficient Logging24
• 硬编码凭据13
• File and Directory Information Exposure11
• Plaintext Storage of a Password11
• Password in Configuration File9
• Exposure of Data Element to Wrong Session6
• User Interface (UI) Misrepresentation of Critical Information6
• LLM06: Sensitive Information Disclosure5
• Storing Passwords in a Recoverable Format4
• Leftover Debug Code (Backdoor)3
• Use of Hard-coded Password3
• Exposure of Sensitive Information Due to Incompatible Policies2
• Cleartext Storage in a File or on Disk1
• Improper Removal of Sensitive Information Before Storage or Transfer1
• Inclusion of Sensitive Information in an Include File1
• Insertion of Sensitive Information into Log File1
• LLM09:2025 Misinformation1
• Use of Cache Containing Sensitive Information1

共现类别

暂无共现数据。

高票报告

当前状态 2,092 份 · 全部 2,092 · 筛选赏金 $536,444

1. 1,601
   Github access token exposureShopify · 2021-07-27 · 严重
   $50,000Unlabeled
2. 1,033
   Confidential data of users and limited metadata of programs and reports accessible via GraphQLHackerOne · 2019-02-03 · 严重
   $0信息泄露
3. 739
   JumpCloud API Key leaked via Open Github Repository.Starbucks · 2019-12-30 · 严重
   $0硬编码凭据
4. 643
   Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterUber · 2019-09-09 · 高危
   $0信息泄露
5. 625
   The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentHackerOne · 2025-04-02 · 严重
   $0信息泄露
6. 589
   Customer private program can disclose email any users through invited via usernameHackerOne · 2020-05-16 · 高危
   $7,500信息泄露
7. 582
   Github Token Leaked publicly for https://github.sc-corp.netSnapchat · 2018-10-08 · 严重
   $0敏感信息明文存储
8. 464
   Access to multiple production Grafana dashboardsSnapchat · 2020-11-04 · 高危
   $10,000信息泄露
9. 458
   [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoUber · 2021-02-26 · 严重
   $40,000敏感信息不安全存储
10. 436
    Open prod Jenkins instanceSnapchat · 2017-08-19 · 高危
    $15,000信息泄露
11. 429
    An attacker can can view any hacker email via /SaveCollaboratorsMutation operation nameHackerOne · 2023-07-04 · 高危
    $12,500信息泄露
12. 410
    gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readGitLab · 2020-06-08 · 严重
    $10,000信息泄露
13. 408
    Employee's GitHub Token Found In Travis CI Build LogsSuperhuman (formerly Grammarly) · 2019-05-22 · 高危
    $5,000信息泄露
14. 380
    Physical Laptop TakeoverEd · 2018-08-12 · 严重
    $0隐私侵犯
15. 366
    JSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsGitLab · 2019-04-21 · 严重
    $12,000信息泄露
16. 355
    Partial disclosure of report activity through new "Export as .zip" featureHackerOne · 2016-11-29 · 高危
    $10,000信息泄露
17. 344
    Github information leakedSemrush · 2019-09-25 · 高危
    $0信息泄露
18. 332
    Connection informaton is sent to a third-party serviceNord Security · — · 未评级
    $0隐私侵犯
19. 321
    AWS bucket leading to iOS test build code and configuration exposureSlack · 2019-02-23 · 严重
    $1,500信息泄露
20. 295
    Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`HackerOne · 2025-01-22 · 严重
    $25,000Unlabeled
21. 287
    Information Disclosure in /skills callHackerOne · 2017-01-06 · 中危
    $10,000信息泄露
22. 280
    Brave Browser Tor Window leaks user's real IP to the external DNS serverBrave Software · 2021-06-17 · 高危
    $0信息泄露
23. 278
    Exfiltrating a victim's exact location (to within 5m)Bumble · 2021-07-22 · 高危
    $0信息泄露
24. 269
    Internal attachments can be exported via "Export as .zip" featureHackerOne · 2016-11-30 · 高危
    $12,500信息泄露
25. 265
    OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageSemrush · 2020-06-18 · 中危
    $0信息泄露