Browse / GSA Bounty

GSA Bounty

See its reports on the map

What gets reported to GSA Bounty

• Misconfiguration8
• Authentication6
• Information Disclosure5
• Cross-site Scripting5
• Access Control5
• Open Redirect4

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agent SQL Injection · critical
   699 votes
2. HTTP Request Smuggling on https://labs.data.govHTTP Request Smuggling · high
   $750160 votes
3. Nginx misconfiguration leading to direct PHP source code downloadInformation Disclosure · high
   145 votes
4. Defacement of catalog.data.gov via web cache poisoning to stored DOMXSSCross-site Scripting (XSS) - Stored · high
   $75093 votes
5. Stealing Users OAuth Tokens through redirect_uri parameterOpen Redirect · high
   $75067 votes
6. Blind SSRF on https://labs.data.gov/dashboard/Campaign/json_status/ EndpointUse of Inherently Dangerous Function · medium
   $30061 votes
7. Link poisoning on https://secure.login.gov/ login pageOpen Redirect · low
   $15060 votes
8. CI for [example.gov] can be logged in and accessibleImproper Access Control - Generic · critical
   $2,00049 votes
9. Limited LFIRemote File Inclusion · medium
   $30048 votes
10. SSRF in Search.gov via ?url= parameterServer-Side Request Forgery (SSRF) · low
    $15043 votes
11. SSRF/XSPA in labs.data.gov/dashboard/validateServer-Side Request Forgery (SSRF) · medium
    $30041 votes
12. HTML injection (with XSS possible) on the https://www.data.gov/issue/ using media_url attributeCross-site Scripting (XSS) - Reflected · medium
    41 votes
13. Improper Session management can cause account takeover[https://micropurchase.18f.gov]Insufficient Session Expiration · medium
    36 votes
14. Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's hostCross-Site Request Forgery (CSRF) · medium
    34 votes
15. Reflected XSS on the data.gov (WAF bypass+ Chrome XSS Auditor bypass+ works in all browsers)Cross-site Scripting (XSS) - Reflected · medium
    28 votes
16. Cache poisoning DoS to various TTS assetsViolation of Secure Design Principles · high
    26 votes
17. [idp.fr.cloud.gov] Open RedirectOpen Redirect · low
    $15025 votes
18. {REDACTED}.data.gov subdomain takeover.Violation of Secure Design Principles · high
    24 votes
19. Information disclosure (system username) in the x-amz-meta-s3cmd-attrs response header on federation.data.govInformation Disclosure · low
    23 votes
20. [IDOR] The authenticated user can restart website build or view build logs on any another Federalist accountInsecure Direct Object Reference (IDOR) · medium
    23 votes
21. Root user disclosure in data.gov domain though x-amz-meta-s3cmd-attrs headerInformation Disclosure · low
    22 votes
22. Blind Stored XSS In "Report a Problem" on www.data.gov/issue/Cross-site Scripting (XSS) - Stored · medium
    $30021 votes
23. Subdomain take-over of {REDACTED}.18f.govPrivilege Escalation · high
    20 votes
24. Unclaimed Github Repository Takeover on https://www.data.gov/labsPhishing · low
    19 votes
25. Subdomain Takeover due to unclaimed domain pointing to AWSOff-by-one Error · low
    17 votes
26. Race condition on the Federalist API endpoints can lead to the Denial of Service attackViolation of Secure Design Principles · low
    17 votes
27. The Federalsit session cookie (federalist.sid) is not properly invalidated - backdoor access to the account is possibleInsufficient Session Expiration · low
    16 votes
28. The user, who was deleted from Github Organization, still can access all functions of federalist, in case he didn't do logoutImproper Authentication - Generic · medium
    16 votes
29. Multiple Bugs in api.data.gov/signup endpoint leads to send custom messages to Anyonemedium
    15 votes
30. Double Stored Cross-Site scripting in the admin panelCross-site Scripting (XSS) - Stored · medium
    15 votes
31. Wordpress Users Disclosure (/wp-json/wp/v2/users/) on data.govInformativeInformation Disclosure · medium
    14 votes
32. Redirect on authorization allows account compromiseImproper Authentication - Generic · critical
    14 votes
33. SSH server compatible with several vulnerable cryptographic algorithmsUse of a Broken or Risky Cryptographic Algorithm · medium
    14 votes
34. open redirect in eb9f.pivcac.prod.login.govOpen Redirect · low
    $15013 votes
35. Denial of service via cache poisoning on https://www.data.gov/DuplicateUncontrolled Resource Consumption · high
    12 votes
36. 2FA bypass - confirmation tokens don't expireImproper Access Control - Generic · medium
    11 votes
37. xmlrpc.php file enabled - data.govDuplicateImproper Access Control - Generic · medium
    10 votes
38. Content injection via URL parameter.DuplicateCode Injection
    9 votes
39. CSRF to change Account Security Keys on secure.login.govCross-Site Request Forgery (CSRF) · medium
    8 votes
40. Email Spoofing - SPF record set to NeutralInformativeViolation of Secure Design Principles
    7 votes
41. Subdomain TakeoverPrivilege Escalation · high
    6 votes
42. Homo graphs attack InformativeViolation of Secure Design Principles
    6 votes
43. [api.data.gov] Leak Valid API With out Verification -InformativeImproper Authentication - Generic
    6 votes
44. Server Side Misconfiguration (EMAIL SPOOFING) N/AImproper Authentication - Generic
    6 votes
45. Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.govDuplicateInformation Disclosure · low
    5 votes
46. CSRF in generating a new Personal KeyDuplicateCross-Site Request Forgery (CSRF) · medium
    4 votes
47. federalist.18f.gov vulnerable to Sweet32 attackInformativeMan-in-the-Middle · medium
    3 votes
48. Email Spoofing - SPF record set to NeutralInformativeViolation of Secure Design Principles
    2 votes
49. Error Page Content Spoofing or Text InjectionDuplicateViolation of Secure Design Principles