Browse / Information Disclosure

Information Disclosure

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Information Disclosure1,552
• Privacy Violation83
• Cleartext Storage of Sensitive Information74
• Insecure Storage of Sensitive Information55
• Cleartext Transmission of Sensitive Information45
• Information Exposure Through an Error Message41
• Information Exposure Through Directory Listing36
• Information Exposure Through Debug Information35
• Information Exposure Through Sent Data30
• File and Directory Information Exposure11
• Missing Encryption of Sensitive Data10
• Exposure of Data Element to Wrong Session6
• LLM06: Sensitive Information Disclosure5
• Information Exposure Through Timing Discrepancy3
• Leftover Debug Code (Backdoor)3
• Exposure of Sensitive Information Due to Incompatible Policies2
• Use of Cache Containing Sensitive Information1
• Inclusion of Sensitive Information in an Include File1
• Cleartext Storage in a File or on Disk1
• Insertion of Sensitive Information into Log File1
• Improper Removal of Sensitive Information Before Storage or Transfer1

Often found together with

• Access Control209
• Authentication132
• Misconfiguration123
• Cross-site Scripting120
• Insecure Direct Object Reference66
• SQL Injection63
• Cross-Site Request Forgery61
• Memory Corruption56
• Server-Side Request Forgery53
• Path Traversal51
• Code Execution50
• Business Logic37
• Denial of Service29

Most upvoted Information Disclosure reports

AllValidInformativeN/ADuplicate

1. Confidential data of users and limited metadata of programs and reports accessible via GraphQLInformation Disclosure · critical · HackerOne
   1,033 votes
2. Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterInformation Disclosure · high · Uber
   643 votes
3. The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentInformation Disclosure · critical · HackerOne
   625 votes
4. Customer private program can disclose email any users through invited via usernameInformation Disclosure · high · HackerOne
   $7,500589 votes
5. Github Token Leaked publicly for https://github.sc-corp.netCleartext Storage of Sensitive Information · critical · Snapchat
   582 votes
6. Access to multiple production Grafana dashboardsInformation Disclosure · high · Snapchat
   $10,000464 votes
7. [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoInsecure Storage of Sensitive Information · critical · Uber
   $40,000458 votes
8. Open prod Jenkins instanceInformation Disclosure · high · Snapchat
   $15,000436 votes
9. An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name Information Disclosure · high · HackerOne
   $12,500429 votes
10. gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be readInformation Disclosure · critical · GitLab
    $10,000410 votes
11. touch.mail.ru / e.mail.ru memory content disclosureInformation Disclosure · Mail.ru
    $10,000409 votes
12. Employee's GitHub Token Found In Travis CI Build LogsInformation Disclosure · high · Superhuman (formerly Grammarly)
    $5,000408 votes
13. Physical Laptop TakeoverPrivacy Violation · critical · Ed
    380 votes
14. Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgCleartext Transmission of Sensitive Information · high · Uber
    $4,000376 votes
15. JSON serialization of any Project model results in all Runner tokens being exposed through Quick ActionsInformation Disclosure · critical · GitLab
    $12,000366 votes
16. Partial disclosure of report activity through new "Export as .zip" featureInformation Disclosure · high · HackerOne
    $10,000355 votes
17. Github information leakedInformation Disclosure · high · Semrush
    344 votes
18. Connection informaton is sent to a third-party servicePrivacy Violation · Nord Security
    332 votes
19. AWS bucket leading to iOS test build code and configuration exposureInformation Disclosure · critical · Slack
    $1,500321 votes
20. Information Disclosure in /skills callInformation Disclosure · medium · HackerOne
    $10,000287 votes
21. Brave Browser Tor Window leaks user's real IP to the external DNS serverInformation Disclosure · high · Brave Software
    280 votes
22. Exfiltrating a victim's exact location (to within 5m)Information Disclosure · high · Bumble
    278 votes
23. Internal attachments can be exported via "Export as .zip" featureInformation Disclosure · high · HackerOne
    $12,500269 votes
24. OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageInformation Disclosure · medium · Semrush
    265 votes
25. AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in BasecampInformation Disclosure · high · Basecamp
    $8,868248 votes
26. Google API key leaked to PublicInformation Disclosure · low · FetLife
    228 votes
27. Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports informationInformation Disclosure · medium · HackerOne
    226 votes
28. file read on MCS servers via supplying a QCOW2 image with external backing fileInformation Disclosure · Mail.ru
    $15,000222 votes
29. Google Docs link in JS files allows editing & reading survey informationInformation Disclosure · medium · HackerOne
    217 votes
30. Password Reset Link Leaked In Refer Header In Request To Third Party Sites Cleartext Transmission of Sensitive Information · Nord Security
    215 votes
31. Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve statusInformation Disclosure · low · HackerOne
    $500213 votes
32. Debug Mode Leak Critical Information [ AWS Keys , SMTP , Database , Django Secret Key ( RCE ) , Dodoc , Telegram , Twilio .. ]Information Disclosure · Mail.ru
    205 votes
33. Stealing Facebook OAuth Code Through Screenshot viewerInformation Disclosure · medium · Rockstar Games
    200 votes
34. Blocked user can see live videoPrivacy Violation · medium · TikTok
    $418198 votes
35. sdrc.starbucks.com - Information Disclosure via unsecured attachment directoryInformation Disclosure · critical · Starbucks
    197 votes
36. An invite-only's program submission state is accessible to users no longer part of the programInformation Disclosure · low · HackerOne
    $500194 votes
37. Unauthorized access to metadata of undisclosed reports that were retestedInformation Disclosure · medium · HackerOne
    189 votes
38. Chaining Bugs: Leakage of CSRF token which leads to Stored XSS and Account Takeover (xs1.tribalwars.cash)Insecure Storage of Sensitive Information · InnoGames
    $1,100186 votes
39. How The Hackers Saved ChristmasInformation Disclosure · critical · h1-ctf
    179 votes
40. Disclosure of `payment_transactions` for programs via GraphQL queryInformation Disclosure · medium · HackerOne
    178 votes
41. Information Disclosure through Sentry Instance ███████Information Exposure Through Debug Information · high · Eternal
    $750178 votes
42. 404-response contains debug-information with all headersInformation Exposure Through Debug Information · low · HackerOne
    173 votes
43. Total Paid Bounty Paid can be discloseInformation Disclosure · low · HackerOne
    $500168 votes
44. Snippet JS template allows attacker to read a user's private snippetsInformation Disclosure · low · GitLab
    $300165 votes
45. Cache Deception Allows Account TakeoverUse of Cache Containing Sensitive Information · high · Expedia Group Bug Bounty
    160 votes
46. Information disclosure via a misconfigured third-party productInformation Disclosure · high · Algolia
    156 votes
47. Information disclosure with sensitive dataInformation Disclosure · Mail.ru
    $1,500156 votes
48. Twitter ID exposure via error-based side-channel attackPrivacy Violation · medium · X / xAI
    $1,470154 votes
49. Access to all files of remote user through shared fileInformation Disclosure · medium · Nextcloud
    154 votes
50. Informations disclosure - Access to some checkout informationsInformation Disclosure · medium · Shopify
    150 votes
51. Public and secret api key leaked in JavaScript sourceCleartext Storage of Sensitive Information · medium · Stripo Inc
    148 votes
52. Discrepancy in hacker profile report count may reveal existence of a private program by publishing a reportInformation Disclosure · medium · HackerOne
    $3,000147 votes
53. Team object in GraphQL disclosed private_commentInformation Disclosure · medium · HackerOne
    $2,500146 votes
54. information disclosure of secret_key_base via encoding charctersInformation Exposure Through an Error Message · high · GitLab
    $3,500146 votes
55. Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}Information Disclosure · high · pixiv
    145 votes
56. Leaking sensitive information on Github lead full access to all Grab Slack channels Information Disclosure · critical · Grab
    145 votes
57. Nginx misconfiguration leading to direct PHP source code downloadInformation Disclosure · high · GSA Bounty
    145 votes
58. Email enumeration of usersInformation Disclosure · medium · Homebrew
    145 votes
59. Unauthorized user can obtain `report_sources` attribute through Team GraphQL objectInformation Disclosure · medium · HackerOne
    $2,500142 votes
60. Lack of CSRF header validation at https://g-mail.grammarly.com/profileInformation Disclosure · medium · Superhuman (formerly Grammarly)
    140 votes
61. Disclose any user's private email through APIInformation Disclosure · medium · HackerOne
    140 votes
62. Private program disclosure via `vpn_suspended` GraphQL queryInformation Disclosure · HackerOne
    $2,500138 votes
63. Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.ioInformation Disclosure · high · Snapchat
    $15,000137 votes
64. [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users imageInformation Disclosure · medium · Shopify
    $2,900135 votes
65. View storyboard of private video @ ht.pornhub.comInformation Disclosure · Pornhub
    $750130 votes
66. Intent Leads To Unauthorised Video Call Initiation Leaking Surrounding Informations Of VictimPrivacy Violation · medium · Snapchat
    127 votes
67. Searching from Hacktivity returns hits for words in limited disclosure reports that are not visibleInformation Disclosure · medium · HackerOne
    127 votes
68. Accessible Druid Monitor console on https://api.pay-staging.razer.com/Information Disclosure · Razer
    $1,500126 votes
69. Full access to InDrive jira panel via exposed API token Information Disclosure · critical · inDrive
    125 votes
70. Client secret, server tokens for developer applications returned by internal APIInformation Disclosure · Uber
    125 votes
71. Netlify Authentication Token Exposed in Public Mozilla CI LogsInformation Disclosure · critical · Mozilla
    123 votes
72. Unauthenticated LFI revealing log informationInformation Disclosure · high · Slack
    123 votes
73. Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]Information Disclosure · critical · X / xAI
    121 votes
74. Changing email address on Twitter for Android unsets "Protect your Tweets"Privacy Violation · low · X / xAI
    $2,940119 votes
75. Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████Information Disclosure · medium · HackerOne
    118 votes
76. Internal Gitlab Ticket Disclosure via External Slack ChannelsInformation Disclosure · high · HackerOne
    118 votes
77. HTML Injection in Swing can disclose netNTLM hash or cause DoSInformation Disclosure · medium · PortSwigger Web Security
    $1,000117 votes
78. China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API EndpointInformation Disclosure · critical · Starbucks
    116 votes
79. Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS FileInformation Disclosure · medium · X / xAI
    $1,500115 votes
80. Possible to steal any protected files on AndroidInformation Disclosure · medium · ownCloud
    $750115 votes
81. Adding phone number to profile By OTP brute forcingInsecure Storage of Sensitive Information · medium · CoinMate.io
    $100114 votes
82. [Zomato Order] Insecure deeplink leads to sensitive information disclosureInformation Disclosure · high · Eternal
    $750114 votes
83. Read files on application server, leads to RCEInformation Disclosure · critical · GitLab
    114 votes
84. Sensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/Information Disclosure · low · Nextcloud
    113 votes
85. Slack token leaking in stackoverflow and devtimes Cleartext Storage of Sensitive Information · Shipt
    $300113 votes
86. Apache Airflow: Sensitive Information Exposure in DAG Run LogsInformation Disclosure · medium · Internet Bug Bounty
    112 votes
87. ubernycmarketplace.com is vulnerable to the Heartbleed BugInformation Disclosure · low · Uber
    $1,500112 votes
88. Emails of invited collaborators are disclosed in full in payload for report participantsInformation Disclosure · low · HackerOne
    112 votes
89. Can see phone numbers of others by providing mail addressInformation Disclosure · high · LinkedIn
    111 votes
90. SSRF via Office file thumbnailsInformation Disclosure · critical · Slack
    $4,000109 votes
91. Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )Cleartext Storage of Sensitive Information · critical · Khan Academy
    107 votes
92. GraphQL field on Team node can be used to determine if External Program runs invite-only programInformation Disclosure · medium · HackerOne
    $2,500107 votes
93. Able to view hackerone reports attachmentsInsecure Storage of Sensitive Information · critical · GitLab
    103 votes
94. Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scopePrivacy Violation · medium · Nextcloud
    $250101 votes
95. Creation of bounties through Customer API leads to private email disclosureInformation Disclosure · critical · HackerOne
    101 votes
96. LINE Profile ID leaks in OpenChatInformation Disclosure · high · LY Corporation
    $3,000101 votes
97. Access body and title of Internal Repo Issues in ProjectsInformation Disclosure · medium · GitHub
    100 votes
98. User data not anonymized is sent to analytics serverPrivacy Violation · Nord Security
    100 votes
99. Real Time Error Logs Through Debug InformationInformation Exposure Through Debug Information · high · Slack
    100 votes
100. Public google drive link Exposes Military Orders Containing PII (Name, SSN etc..) and Operational DetailsInformation Disclosure · critical · U.S. Dept Of Defense
     99 votes