Browse / HackerOne

HackerOne

See its reports on the map

What gets reported to HackerOne

• Information Disclosure160
• Misconfiguration99
• Access Control71
• Authentication48
• Business Logic40
• Cross-site Scripting32

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Account takeover via leaked session cookieInsufficiently Protected Credentials · high
   $20,0001,642 votes
2. Confidential data of users and limited metadata of programs and reports accessible via GraphQLInformation Disclosure · critical
   1,033 votes
3. WannaCrypt “Killswitch”
   809 votes
4. Email address of any user can be queried on Report Invitation GraphQL type when username is knownImproper Authorization · high
   671 votes
5. The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is presentInformation Disclosure · critical
   625 votes
6. Customer private program can disclose email any users through invited via usernameInformation Disclosure · high
   $7,500589 votes
7. Server Side Request Forgery (SSRF) via Analytics ReportsServer-Side Request Forgery (SSRF) · critical
   $25,000529 votes
8. profile-picture name parameter with large value lead to DoS for other users and programs on the platformUncontrolled Resource Consumption · medium
   475 votes
9. How the Bug stole hackingInsecure Direct Object Reference (IDOR)
   471 votes
10. An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name Information Disclosure · high
    $12,500429 votes
11. June 2022 Incident Reportcritical
    426 votes
12. IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL queryInsecure Direct Object Reference (IDOR) · high
    395 votes
13. Reflected XSS on www.hackerone.com and resources.hackerone.comCross-site Scripting (XSS) - Reflected · low
    $500387 votes
14. IDOR allows user to access report details via reference.json endpointInsecure Direct Object Reference (IDOR) · critical
    $15,000372 votes
15. [CVE-2022-44268] Arbitrary Remote Leak via ImageMagickRemote File Inclusion · critical
    371 votes
16. Hackerone is not properly deleting user idBusiness Logic Errors · medium
    356 votes
17. Partial disclosure of report activity through new "Export as .zip" featureInformation Disclosure · high
    $10,000355 votes
18. Insecure Direct Object Reference (IDOR) - Delete Campaigns Insecure Direct Object Reference (IDOR) · high
    346 votes
19. Attachment disclosure via summary report Insecure Direct Object Reference (IDOR) · critical
    340 votes
20. Getting New Invitations without Leaving ProgramsBusiness Logic Errors · low
    322 votes
21. An attacker can archive and unarchive any structured scope object on HackerOnehigh
    318 votes
22. Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`Improper Access Control - Generic · critical
    $25,000295 votes
23. Information Disclosure in /skills callInformation Disclosure · medium
    $10,000287 votes
24. Internal attachments can be exported via "Export as .zip" featureInformation Disclosure · high
    $12,500269 votes
25. Team member with Program permission only can escalate to Admin permissionPrivilege Escalation · medium
    268 votes
26. Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json EndpointInsecure Direct Object Reference (IDOR) · critical
    266 votes
27. View Titles of Private Reports with pending email invitationImproper Access Control - Generic · high
    257 votes
28. Denial of service via cache poisoningUncontrolled Resource Consumption · medium
    $2,500253 votes
29. Race condition in performing retest allows duplicated paymentsConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') · medium
    240 votes
30. Cross-site Scripting (XSS) on HackerOne careers pageCross-site Scripting (XSS) - DOM · low
    $500239 votes
31. Reflected XSS on www.hackerone.com via Wistia embed codeCross-site Scripting (XSS) - Reflected · low
    $500236 votes
32. Account takeover of existing HackerOne accounts through SCIM provisioningImproper Access Control - Generic · high
    232 votes
33. HackerOne SAML signup domain enforcement bypass results in unauthorized access to HackerOne PullRequest organizationImproper Null Termination · high
    228 votes
34. Static files on HackerOne.com can be made inaccessible through Cache Poisoning attackUncontrolled Resource Consumption · medium
    228 votes
35. Internal Access to Hackerone confluence DocsMisconfiguration · high
    $12,500227 votes
36. Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports informationInformation Disclosure · medium
    226 votes
37. Google Docs link in JS files allows editing & reading survey informationInformation Disclosure · medium
    217 votes
38. HackerOne Jira integration plugin Leaked JWT to unauthorized jira usersImproper Authentication - Generic · medium
    $3,000213 votes
39. Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve statusInformation Disclosure · low
    $500213 votes
40. IDOR vulnerability in unreleased HackerOne Copilot featureInsecure Direct Object Reference (IDOR) · medium
    210 votes
41. Uploading large payload on domain instructions causes server-side DoSUncontrolled Resource Consumption · medium
    $2,500210 votes
42. Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formImproper Authorization · medium
    $10,000208 votes
43. DOM Based XSS in www.hackerone.com via PostMessageCross-site Scripting (XSS) - DOM · low
    $500208 votes
44. HackerOne making payments in USDC (Coinbase stable coin)Business Logic Errors
    201 votes
45. 2020-10-09 Credential Stuffing Attack
    196 votes
46. Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photosViolation of Secure Design Principles · medium
    194 votes
47. An invite-only's program submission state is accessible to users no longer part of the programInformation Disclosure · low
    $500194 votes
48. Unauthorized access to metadata of undisclosed reports that were retestedInformation Disclosure · medium
    189 votes
49. adding h1_analyst_* to username for normal users Business Logic Errors · low
    $500187 votes
50. DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification APIUncontrolled Resource Consumption
    185 votes
51. Markdown parsing issue enables insertion of malicious tags and event handlersCross-site Scripting (XSS) - Stored · high
    $5,000184 votes
52. IDOR Vulnerability at AddTagToAssets operation nameInsecure Direct Object Reference (IDOR) · medium
    178 votes
53. Disclosure of `payment_transactions` for programs via GraphQL queryInformation Disclosure · medium
    178 votes
54. Account creation with invalid email addresses / email is accepting % and %0d%0a line termination charsViolation of Secure Design Principles · low
    $3,750176 votes
55. Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphqlCode Injection · high
    $7,000174 votes
56. SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameterSQL Injection · critical
    174 votes
57. 404-response contains debug-information with all headersInformation Exposure Through Debug Information · low
    173 votes
58. RXSS at image.hackerone.live via the `url` parameterCross-site Scripting (XSS) - Reflected · low
    $500171 votes
59. Improper CSRF token validation allows attackers to access victim's accounts linked to HackeroneCross-Site Request Forgery (CSRF) · high
    168 votes
60. Total Paid Bounty Paid can be discloseInformation Disclosure · low
    $500168 votes
61. Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpointInsecure Direct Object Reference (IDOR) · low
    161 votes
62. Web Authentication Endpoint Credentials Brute-Force VulnerabilityImproper Authentication - Generic
    161 votes
63. LLM01: Invisible Prompt InjectionLLM01: Prompt Injection · medium
    159 votes
64. IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifierCross-site Scripting (XSS) - Stored · medium
    $2,500156 votes
65. Hackerone supports accounts organitation takeovermedium
    $2,500155 votes
66. Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.comBusiness Logic Errors · low
    154 votes
67. Hacker.One Subdomain TakeoverViolation of Secure Design Principles · low
    154 votes
68. Race Condition leads to undeletable group memberTime-of-check Time-of-use (TOCTOU) Race Condition · low
    153 votes
69. Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONPViolation of Secure Design Principles
    153 votes
70. Banned user still has access to their deleted account via HackerOne's API using their API keyImproper Access Control - Generic · medium
    150 votes
71. [ Spot Check ] Team members can edit a user's write-upImproper Access Control - Generic · low
    149 votes
72. Slack integration setup lacks CSRF protectionCross-Site Request Forgery (CSRF) · high
    $2,500149 votes
73. Discrepancy in hacker profile report count may reveal existence of a private program by publishing a reportInformation Disclosure · medium
    $3,000147 votes
74. Stored XSS in IE11 on hackerone.com via custom fields Cross-site Scripting (XSS) - Stored · medium
    146 votes
75. Team object in GraphQL disclosed private_commentInformation Disclosure · medium
    $2,500146 votes
76. h1-202 leaderboard photo discloses local wifi password Insufficiently Protected Credentials · medium
    145 votes
77. Blind SSRF on errors.hackerone.net due to Sentry misconfigurationServer-Side Request Forgery (SSRF) · low
    $3,500143 votes
78. Unauthorized user can obtain `report_sources` attribute through Team GraphQL objectInformation Disclosure · medium
    $2,500142 votes
79. Server Side Request Forgery (SSRF) in webhook functionalityServer-Side Request Forgery (SSRF) · medium
    $2,500140 votes
80. Disclose any user's private email through APIInformation Disclosure · medium
    140 votes
81. Bypassing HackerOne 2FA due to race conditionBusiness Logic Errors · medium
    139 votes
82. Banned researcher gets email updates on a private program.Improper Access Control - Generic
    139 votes
83. Payload delivery via Social Media urls on H1 profileRemote File Inclusion · medium
    138 votes
84. Private program disclosure via `vpn_suspended` GraphQL queryInformation Disclosure
    $2,500138 votes
85. Takeover of hackerone.engineering via GithubPrivilege Escalation · medium
    135 votes
86. Subdomain takeover at info.hacker.onePrivilege Escalation · low
    134 votes
87. Disclosure handle private program with external linkImproper Access Control - Generic · medium
    $2,500130 votes
88. Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.comCross-site Scripting (XSS) - Generic · medium
    129 votes
89. Searching from Hacktivity returns hits for words in limited disclosure reports that are not visibleInformation Disclosure · medium
    127 votes
90. Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License AbuseImproper Access Control - Generic · low
    126 votes
91. Race Conditions in Popular reports feature.Memory Corruption - Generic
    125 votes
92. Ability to access policy and updates for unauthorized programImproper Access Control - Generic · medium
    124 votes
93. Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widgetCross-site Scripting (XSS) - Stored · medium
    122 votes
94. Any user could upload attachments to pentest scoping form they don't have access toBusiness Logic Errors · high
    121 votes
95. Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████Information Disclosure · medium
    118 votes
96. Internal Gitlab Ticket Disclosure via External Slack ChannelsInformation Disclosure · high
    118 votes
97. Account recovery text message is sending a wrong domain to users.Business Logic Errors · low
    117 votes
98. @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.Business Logic Errors · medium
    117 votes
99. HackerOne Code sends live password-reset tokens to Segment in automatic page eventsInsufficiently Protected Credentials · low
    $200115 votes
100. Emails of invited collaborators are disclosed in full in payload for report participantsInformation Disclosure · low
     112 votes