HackerOne

HackerOne 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 信息泄露172
• 错误配置70
• 访问控制63
• 身份认证53
• 业务逻辑50
• 其他弱点39
• 跨站脚本32
• 拒绝服务26
• 开放重定向24
• 不安全的直接对象引用20
• 跨站请求伪造18
• 代码执行11
• 密码学缺陷9
• 服务端请求伪造7
• 内存破坏4
• 注入与走私4
• SQL 注入3
• 路径遍历2

主要弱点

• 信息泄露149
• 违反安全设计原则（按标题归类）63
• 访问控制缺陷（通用）35
• Unlabeled33
• 认证缺陷（通用）31
• 业务逻辑错误30
• 资源消耗失控26
• 开放重定向21
• IDOR19
• 跨站请求伪造18

常见资产

• hackerone.comURL · 290
• · 261
• www.hackerone.comURL · 23
• https://ctf.hacker101.comURL · 8
• api.hackerone.comURL · 6
• http://hackerone.com/graphqlURL · 6
• events.hackerone.comURL · 3
• app.pullrequest.comURL · 3
• hackerone.liveURL · 2
• support.hackerone.comURL · 2

高票报告

当前状态 607 份 · 全部 607

1. 1,642
   Account takeover via leaked session cookie身份认证 · 2019-12-04 · 高危
   $20,000凭据保护不足
2. 1,033
   Confidential data of users and limited metadata of programs and reports accessible via GraphQL信息泄露 · 2019-02-03 · 严重
   $0信息泄露
3. 809
   WannaCrypt “Killswitch”密码学缺陷 · 2017-05-13 · 未评级
   $0Unlabeled
4. 671
   Email address of any user can be queried on Report Invitation GraphQL type when username is known访问控制 · 2020-02-21 · 高危
   $0授权不当
5. 625
   The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present信息泄露 · 2025-04-02 · 严重
   $0信息泄露
6. 589
   Customer private program can disclose email any users through invited via username信息泄露 · 2020-05-16 · 高危
   $7,500信息泄露
7. 529
   Server Side Request Forgery (SSRF) via Analytics Reports服务端请求伪造 · 2023-12-09 · 严重
   $25,000SSRF
8. 475
   profile-picture name parameter with large value lead to DoS for other users and programs on the platform拒绝服务 · 2020-03-25 · 中危
   $0资源消耗失控
9. 471
   How the Bug stole hacking不安全的直接对象引用 · 2019-12-21 · 低危
   $0IDOR
10. 429
    An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name信息泄露 · 2023-07-04 · 高危
    $12,500信息泄露
11. 426
    June 2022 Incident Report其他弱点 · 2022-07-02 · 严重
    $0Unlabeled
12. 395
    IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query不安全的直接对象引用 · 2023-08-29 · 高危
    $0IDOR
13. 387
    Reflected XSS on www.hackerone.com and resources.hackerone.com跨站脚本 · 2020-05-06 · 低危
    $500反射型 XSS
14. 372
    IDOR allows user to access report details via reference.json endpoint不安全的直接对象引用 · 2026-10-01 · 严重
    $15,000IDOR
15. 371
    [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick代码执行 · 2023-03-16 · 严重
    $0远程文件包含
16. 356
    Hackerone is not properly deleting user id业务逻辑 · 2021-06-12 · 中危
    $0业务逻辑错误
17. 355
    Partial disclosure of report activity through new "Export as .zip" feature信息泄露 · 2016-11-29 · 高危
    $10,000信息泄露
18. 346
    Insecure Direct Object Reference (IDOR) - Delete Campaigns不安全的直接对象引用 · 2023-05-03 · 高危
    $0IDOR
19. 340
    Attachment disclosure via summary report不安全的直接对象引用 · 2024-04-29 · 严重
    $0IDOR
20. 322
    Getting New Invitations without Leaving Programs业务逻辑 · 2020-10-16 · 低危
    $0业务逻辑错误
21. 318
    An attacker can archive and unarchive any structured scope object on HackerOne其他弱点 · 2022-04-19 · 高危
    $0Unlabeled
22. 295
    Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`信息泄露 · 2025-01-22 · 严重
    $25,000Unlabeled
23. 287
    Information Disclosure in /skills call信息泄露 · 2017-01-06 · 中危
    $10,000信息泄露
24. 269
    Internal attachments can be exported via "Export as .zip" feature信息泄露 · 2016-11-30 · 高危
    $12,500信息泄露
25. 268
    Team member with Program permission only can escalate to Admin permission访问控制 · 2019-06-27 · 中危
    $0权限提升