错误配置

代码没问题，部署出了问题：子域名接管、公开的存储桶、过宽的 CORS 与遗留的默认账号。

影响

接管子域名、读取公开存储中的敏感文件或绕过同源保护

观察点

目标资源可以被未授权方访问或接管

修复

建立资产清单并定期巡检 DNS 记录、云存储权限与 CORS 配置，移除默认凭据。

弱点分布

• 违反安全设计原则（按标题归类）531
• 点击劫持140
• 错误配置83
• Unlabeled70
• Security Through Obscurity7
• Using Components with Known Vulnerabilities2
• Insecure Default Initialization of Resource1

共现类别

暂无共现数据。

高票报告

当前状态 834 份 · 全部 834 · 筛选赏金 $94,866

1. 310
   Able to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationShopify · 2020-04-02 · 中危
   $0Unlabeled
2. 282
   Cross-site Scripting (XSS) - Stored in RDoc wiki pagesGitLab · 2019-12-16 · 高危
   $3,500点击劫持
3. 258
   Bruteforce password recovery codeBumble · 2020-01-19 · 未评级
   $0违反安全设计原则（按标题归类）
4. 246
   [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive informationEternal · 2018-11-28 · 中危
   $550Unlabeled
5. 234
   Spring Actuator endpoints publicly available and broken authenticationLY Corporation · 2020-08-06 · 严重
   $12,500错误配置
6. 227
   Internal Access to Hackerone confluence DocsHackerOne · 2025-08-15 · 高危
   $12,500错误配置
7. 221
   Ability To Delete User(s) Account Without User InteractionGitLab · 2021-03-18 · 高危
   $0错误配置
8. 176
   Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsHackerOne · 2024-02-05 · 低危
   $3,750违反安全设计原则（按标题归类）
9. 155
   Hackerone supports accounts organitation takeoverHackerOne · 2024-11-19 · 中危
   $2,500Unlabeled
10. 154
    Hacker.One Subdomain TakeoverHackerOne · 2016-09-21 · 低危
    $0违反安全设计原则（按标题归类）
11. 153
    Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPHackerOne · 2017-08-29 · 未评级
    $0违反安全设计原则（按标题归类）
12. 144
    Twitter Periscope Clickjacking VulnerabilityX / xAI · 2019-07-10 · 中危
    $1,120点击劫持
13. 143
    Spring Actuator endpoints publicly available, leading to account takeoverLY Corporation · 2020-08-04 · 严重
    $5,000错误配置
14. 134
    Highly wormable clickjacking in player cardX / xAI · 2018-05-18 · 未评级
    $0点击劫持
15. 133
    Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageSemrush · 2020-01-10 · 中危
    $0违反安全设计原则（按标题归类）
16. 131
    Session Cookie Leakage via Static Header Field in WebViewerFragmentLinkedIn · 2026-03-17 · 高危
    $0错误配置
17. 115
    [Critical] Delete any accountOLX · — · 未评级
    $0违反安全设计原则（按标题归类）
18. 114
    IDOR leading to downloading of any attachmentBCM Messenger · 2020-04-11 · 低危
    $0违反安全设计原则（按标题归类）
19. 114
    Subdomain takeover on http://fastly.sc-cdn.net/Snapchat · 2016-08-23 · 未评级
    $3,000违反安全设计原则（按标题归类）
20. 108
    Recently added 'Country' field doesn't send email notification when changedHackerOne · 2020-08-25 · 低危
    $0违反安全设计原则（按标题归类）
21. 102
    Wordpress Takeover using setup configuration at http://████.edu [HtUS]U.S. Dept Of Defense · 2023-01-14 · 严重
    $1,000错误配置
22. 101
    Mass account takeover!Stripe · 2022-12-22 · 高危
    $0错误配置
23. 101
    Exposed Cortex API at https://cortex-ingest.shopifycloud.com/Shopify · 2022-12-03 · 中危
    $6,300错误配置
24. 100
    Lack of URL normalization renders Blocked-Previews feature ineffectualSlack · 2022-01-16 · 中危
    $1,000Security Through Obscurity
25. 98
    Safe Redirect BypassX / xAI · 2020-09-11 · 低危
    $560Security Through Obscurity