其他弱点

不属于上面任何一类的问题：供应链、依赖混淆、隐私问题以及各种边角情况。

影响

视具体场景而定，可能造成数据泄露或代码被替换

观察点

目标系统出现了不符合预期的行为

修复

根据具体问题制定修复方案，并补充对应的回归测试。

弱点分布

• Unlabeled967
• 输入校验不当76
• 钓鱼41
• Improper Check or Handling of Exceptional Conditions6
• Improper Handling of URL Encoding (Hex Encoding)5
• Insecure Temporary File4
• Use of Incorrectly-Resolved Name or Reference4
• Acceptance of Extraneous Untrusted Data With Trusted Data3
• LLM01: Prompt Injection3
• Encoding Error1
• Improper Handling of Case Sensitivity1
• Improper Handling of Exceptional Conditions1
• Improper Handling of Unexpected Data Type1
• Improper Handling of Unicode Encoding1
• Improper Initialization1
• Improper Validation of Syntactic Correctness of Input1
• Inconsistency Between Implementation and Documented Design1
• Insufficient Verification of Data Authenticity1
• LLM05: Supply Chain Vulnerabilities1
• Misinterpretation of Input1
• Unchecked Error Condition1

共现类别

暂无共现数据。

高票报告

当前状态 1,121 份 · 全部 1,121 · 筛选赏金 $342,565

1. 466
   Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`BlockDev Sp. Z o.o · 2019-10-02 · 严重
   $0输入校验不当
2. 426
   June 2022 Incident ReportHackerOne · 2022-07-02 · 严重
   $0Unlabeled
3. 363
   Bypass of GitLab CI runner slash fix in YAML validationGitLab · 2019-04-10 · 严重
   $0输入校验不当
4. 362
   URL link spoofingSlack · 2020-04-26 · 低危
   $250钓鱼
5. 330
   HTML-injection in PDF-export leads to LFIVisma Public · — · 未评级
   $500Unlabeled
6. 326
   DOM XSS on duckduckgo.com searchDuckDuckGo · 2020-06-14 · 高危
   $0Unlabeled
7. 318
   An attacker can archive and unarchive any structured scope object on HackerOneHackerOne · 2022-04-19 · 高危
   $0Unlabeled
8. 283
   Java (Maven): Actually fix the use of insecure protocol to download/upload artifactsGitHub Security Lab · — · 未评级
   $4,000Unlabeled
9. 222
   Github Account hijack through broken link in developer.twitter.comX / xAI · 2021-02-04 · 高危
   $0钓鱼
10. 202
    Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originSuperhuman (formerly Grammarly) · 2019-08-01 · 严重
    $0Unlabeled
11. 201
    HackerOne making payments in USDC (Coinbase stable coin)HackerOne · 2021-06-17 · 低危
    $0Unlabeled
12. 201
    TestingHackerOne H1P BBP1 · — · 未评级
    $0Unlabeled
13. 196
    2020-10-09 Credential Stuffing AttackHackerOne · 2020-10-14 · 未评级
    $0Unlabeled
14. 185
    DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification APIHackerOne · 2026-04-16 · 未评级
    $0Unlabeled
15. 184
    Remote Command execution due to image tragick██████ · — · 未评级
    $0Unlabeled
16. 178
    protected Tweet settings overwritten by other settingsX / xAI · 2020-01-02 · 中危
    $0Unlabeled
17. 172
    Phone Call to XXE via Interactive Voice Response██████ · — · 未评级
    $0Unlabeled
18. 169
    Незащищённый экземпляр ZeppelinMail.ru · — · 未评级
    $35,000Unlabeled
19. 159
    LLM01: Invisible Prompt InjectionHackerOne · 2024-05-13 · 中危
    $0LLM01: Prompt Injection
20. 154
    Frans Visits Vegas AnnouncementFrans Visits Vegas · 2017-07-21 · 未评级
    $0Unlabeled
21. 140
    `socket` command allows sending data over WebSockets to arbitrary origins from Grammarly ExtensionSuperhuman (formerly Grammarly) · 2019-07-16 · 高危
    $0Unlabeled
22. 139
    Banned researcher gets email updates on a private program.HackerOne · 2019-05-19 · 未评级
    $0Unlabeled
23. 119
    Persistent XSS (unvalidated Open Graph embed) at LinkedIn.comLinkedIn · — · 未评级
    $0Unlabeled
24. 119
    [URGENT] Opportunity to publish tweets on any twitters accountX / xAI · 2017-05-23 · 高危
    $0Unlabeled
25. 114
    Reflected XSS on https://www.uber.comUber · 2021-03-16 · 高危
    $0Unlabeled