HackerOne

HackerOne 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 信息泄露172
• 错误配置70
• 访问控制63
• 身份认证53
• 业务逻辑50
• 其他弱点39
• 跨站脚本32
• 拒绝服务26
• 开放重定向24
• 不安全的直接对象引用20
• 跨站请求伪造18
• 代码执行11
• 密码学缺陷9
• 服务端请求伪造7
• 内存破坏4
• 注入与走私4
• SQL 注入3
• 路径遍历2

主要弱点

• 信息泄露149
• 违反安全设计原则（按标题归类）63
• 访问控制缺陷（通用）35
• Unlabeled33
• 认证缺陷（通用）31
• 业务逻辑错误30
• 资源消耗失控26
• 开放重定向21
• IDOR19
• 跨站请求伪造18

常见资产

• hackerone.comURL · 290
• · 261
• www.hackerone.comURL · 23
• https://ctf.hacker101.comURL · 8
• api.hackerone.comURL · 6
• http://hackerone.com/graphqlURL · 6
• events.hackerone.comURL · 3
• app.pullrequest.comURL · 3
• hackerone.liveURL · 2
• support.hackerone.comURL · 2

高票报告

当前状态 607 份 · 全部 607

1. 266
   Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint不安全的直接对象引用 · 2024-05-24 · 严重
   $0IDOR
2. 257
   View Titles of Private Reports with pending email invitation访问控制 · 2024-01-16 · 高危
   $0访问控制缺陷（通用）
3. 253
   Denial of service via cache poisoning拒绝服务 · 2018-12-23 · 中危
   $2,500资源消耗失控
4. 240
   Race condition in performing retest allows duplicated payments业务逻辑 · 2018-12-27 · 中危
   $0Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
5. 239
   Cross-site Scripting (XSS) on HackerOne careers page跨站脚本 · 2019-02-18 · 低危
   $500DOM 型 XSS
6. 236
   Reflected XSS on www.hackerone.com via Wistia embed code跨站脚本 · 2020-09-25 · 低危
   $500反射型 XSS
7. 232
   Account takeover of existing HackerOne accounts through SCIM provisioning访问控制 · 2025-07-17 · 高危
   $0访问控制缺陷（通用）
8. 228
   HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organization内存破坏 · 2024-02-04 · 高危
   $0Improper Null Termination
9. 228
   Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack拒绝服务 · 2021-12-23 · 中危
   $0资源消耗失控
10. 227
    Internal Access to Hackerone confluence Docs错误配置 · 2025-08-15 · 高危
    $12,500错误配置
11. 226
    Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information信息泄露 · 2025-05-31 · 中危
    $0信息泄露
12. 217
    Google Docs link in JS files allows editing & reading survey information信息泄露 · 2023-11-04 · 中危
    $0信息泄露
13. 213
    HackerOne Jira integration plugin Leaked JWT to unauthorized jira users身份认证 · 2021-04-02 · 中危
    $3,000认证缺陷（通用）
14. 213
    Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status信息泄露 · 2019-09-29 · 低危
    $500信息泄露
15. 210
    IDOR vulnerability in unreleased HackerOne Copilot feature不安全的直接对象引用 · 2023-10-26 · 中危
    $0IDOR
16. 210
    Uploading large payload on domain instructions causes server-side DoS拒绝服务 · 2020-06-20 · 中危
    $2,500资源消耗失控
17. 208
    Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form访问控制 · 2018-11-01 · 中危
    $10,000授权不当
18. 208
    DOM Based XSS in www.hackerone.com via PostMessage跨站脚本 · 2019-02-21 · 低危
    $500DOM 型 XSS
19. 201
    HackerOne making payments in USDC (Coinbase stable coin)其他弱点 · 2021-06-17 · 低危
    $0Unlabeled
20. 196
    2020-10-09 Credential Stuffing Attack其他弱点 · 2020-10-14 · 未评级
    $0Unlabeled
21. 194
    Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos信息泄露 · 2021-03-26 · 中危
    $0违反安全设计原则（按标题归类）
22. 194
    An invite-only's program submission state is accessible to users no longer part of the program信息泄露 · 2020-04-22 · 低危
    $500信息泄露
23. 189
    Unauthorized access to metadata of undisclosed reports that were retested信息泄露 · 2020-06-05 · 中危
    $0信息泄露
24. 187
    adding h1_analyst_* to username for normal users业务逻辑 · 2023-04-12 · 低危
    $500业务逻辑错误
25. 185
    DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API其他弱点 · 2026-04-16 · 未评级
    $0Unlabeled