Browse / Internet Bug Bounty

Internet Bug Bounty

See its reports on the map

What gets reported to Internet Bug Bounty

• Memory Corruption392
• Denial of Service75
• Code Execution61
• Information Disclosure42
• Other weaknesses42
• Cryptography35

Most upvoted reports

AllValidInformativeN/ADuplicate

1. CRLF Injection in urllibCRLF Injection · medium
   $1,000341 votes
2. Key Reinstallation Attacks: Breaking WPA2 by forcing nonce reuseReusing a Nonce, Key Pair in Encryption · medium
   191 votes
3. Apache HTTP [2.4.17-2.4.38] Local Root Privilege EscalationPrivilege Escalation · high
   $1,500121 votes
4. A reflected XSS in python/Lib/DocXMLRPCServer.pyCross-site Scripting (XSS) - Reflected · medium
   118 votes
5. Apache Airflow: Sensitive Information Exposure in DAG Run LogsInformation Disclosure · medium
   112 votes
6. Ubuntu Linux privilege escalation (dirty_sock)Privilege Escalation · high
   103 votes
7. JWT audience claim is not verifiedMissing Critical Step in Authentication · critical
   98 votes
8. Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Path Traversal · critical
   $4,00096 votes
9. Possibility of Request smuggling attackHTTP Request Smuggling · high
   $4,66093 votes
10. moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573) CWE-20 Improper Input ValidationImproper Input Validation · medium
    $2,60089 votes
11. CVE-2022-40604: Apache Airflow: Format String VulnerabilityUse of Externally-Controlled Format String · critical
    $8,00089 votes
12. Deadlock in x86 HVM standard VGA handlingImproper Input Validation · medium
    $2,16288 votes
13. CVE-2024-27281: RCE vulnerability with .rdoc_options in RDocCode Injection · high
    $4,86088 votes
14. CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize()Allocation of Resources Without Limits or Throttling · medium
    $2,16283 votes
15. Possible Sensitive Session Information Leak in Active StorageInformation Disclosure · high
    $4,32382 votes
16. Integrity checks according to policies can be circumvented in Node.js 20 and Node.js 18Insufficient Verification of Data Authenticity · medium
    $1,27082 votes
17. In correct casting from size_t to int lead to heap overflow in mcrypt_genericCode Injection
    $1,00081 votes
18. Secrets not masked in UI when sensitive variables are set via Airflow cliInformation Disclosure · low
    78 votes
19. Libuv: Improper Domain Lookup that potentially leads to SSRF attacksServer-Side Request Forgery (SSRF) · high
    $4,86074 votes
20. Pause-based desync in Apache HTTPDHTTP Request Smuggling · high
    $4,00074 votes
21. HTTP Smuggling multiple issues in Squid 3.x & squid 4.xHTTP Response Splitting · critical
    74 votes
22. Heap Buffer Overflow (READ: 4) in phar_parse_pharfileBuffer Over-read · high
    72 votes
23. CVE-2024-41937: Apache Airflow: Stored XSS Vulnerability on provider linkCross-site Scripting (XSS) - Stored · low
    $49770 votes
24. GMP Deserialization Type Confusion Vulnerability [MyBB <= 1.8.3 RCE Vulnerability]Code Injection · high
    68 votes
25. Path traversal by monkey-patching Buffer internalsPath Traversal · high
    $2,43067 votes
26. Type Confusion Vulnerability - SOAP / make_http_soap_request()Memory Corruption - Generic
    $1,00064 votes
27. CVE-2024-53908: Django Potential SQL injection in `HasKey(lhs, rhs)` on OracleSQL Injection · high
    61 votes
28. [CVE-2024-47888] Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action TextUncontrolled Resource Consumption · low
    $50560 votes
29. CVE-2024-34750 Apache Tomcat DoS vulnerability in HTTP/2 connectorUncontrolled Resource Consumption · high
    $4,92060 votes
30. CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash exampleCode Injection · high
    $4,00060 votes
31. Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflowBuffer Over-read · high
    $1,50058 votes
32. Inappropriate URL parsing may cause security risk!Server-Side Request Forgery (SSRF) · medium
    $1,00058 votes
33. Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cliInsufficient Session Expiration · low
    57 votes
34. CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)HTTP Request Smuggling · high
    $4,66057 votes
35. curl HSTS long file name clears contents Missing Encryption of Sensitive Data · low
    57 votes
36. CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default ServletDeserialization of Untrusted Data · high
    $4,32356 votes
37. Possible DoS Vulnerability with Range Header in RackUncontrolled Resource Consumption · high
    $5,42056 votes
38. ReDoS Vulnerability in HTTP Accept Headers Parsingmedium
    $2,64255 votes
39. CVE-2024-45498: Apache Airflow Command injection in read_dataset_event_from_classic DAGCode Injection · low
    54 votes
40. Proxy-Authorization header not cleared on cross-origin redirect in undici.requestInformation Disclosure · low
    $42054 votes
41. `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periodsImproper Access Control - Generic · low
    $50553 votes
42. CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()SQL Injection · high
    $4,26352 votes
43. Integer overflow leading to buffer overflowInteger Overflow · critical
    $1,00052 votes
44. Race Conditions in OAuth 2 API implementationsImproper Authentication - Generic · medium
    52 votes
45. important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)Improper Input Validation · high
    $4,92051 votes
46. Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)HTTP Request Smuggling · high
    $4,66051 votes
47. ReDoS( Ruby, Time)Uncontrolled Resource Consumption · high
    $4,00051 votes
48. Buffer overflow in PyCArg_repr in _ctypes/callproc.c for Python 3.x to 3.9.1Classic Buffer Overflow · high
    $1,50051 votes
49. CVE-2023-42663: Apache Airflow: Bypass permission verification to view task instances of other dagsImproper Access Control - Generic · low
    $54050 votes
50. Heap overflow in mysqlnd related to BIT fields (CVE-2016-7412)Memory Corruption - Generic · medium
    50 votes
51. netrc and redirect credential leakInformation Disclosure · low
    $50549 votes
52. CVE-2024-41989: Denial-Of-Service vulnerability in the floatformat template filter when input string contains a big exponent in scientific notationUncontrolled Resource Consumption · medium
    $2,14249 votes
53. ASAR Integrity bypass via filetype confusionImproper Access Control - Generic · medium
    $2,54049 votes
54. CVE-2024-2466: TLS certificate check bypass with mbedTLS (reward request)Improper Certificate Validation · medium
    $2,58048 votes
55. Potential DoS vulnerability in Django in multipart parserUncontrolled Resource Consumption · medium
    $2,40047 votes
56. DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)Improper Access Control - Generic · high
    $4,20047 votes
57. CVE-2024-32760 in nginxmedium
    $2,60046 votes
58. CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGsCommand Injection - Generic · high
    46 votes
59. CVE-2024-43398: DoS vulnerability in REXMLUncontrolled Resource Consumption · low
    $50545 votes
60. important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)Server-Side Request Forgery (SSRF) · high
    $4,92045 votes
61. Possible ReDoS vulnerability in query parameter filtering in Action DispatchUncontrolled Resource Consumption · medium
    44 votes
62. Improper handling of wildcards in --allow-fs-read and --allow-fs-writeImproper Access Control - Generic · medium
    $1,29044 votes
63. Path traversal through path stored in Uint8Array in Node.js 20Path Traversal · high
    $3,49544 votes
64. DOS in stream filtersUncontrolled Resource Consumption · high
    44 votes
65. CVE-2024-7347: Buffer overread in the ngx_http_mp4_moduleBuffer Over-read · medium
    $2,14243 votes
66. Open Redirect Vulnerability in Action PackOpen Redirect · medium
    $2,40043 votes
67. Integer overflow in CipherUpdateInteger Overflow · high
    43 votes
68. CVE-2024-2398: HTTP/2 push headers memory-leakInformation Disclosure · medium
    42 votes
69. Denial of Service caused by HTTP/2 CONTINUATION FloodUncontrolled Resource Consumption · high
    $4,86042 votes
70. Permission model improperly protects against path traversal in Node.js 20Path Traversal · high
    $2,33042 votes
71. CVE-2019-11043: a buffer underflow in fpm_main.c can lead to RCE in php-fpmBuffer Underflow · critical
    $1,50042 votes
72. Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.cInteger Overflow · medium
    42 votes
73. OpenSSL vulnerable to the Marvin Attack (CVE-2022-4304)Information Exposure Through Timing Discrepancy · medium
    $2,54041 votes
74. Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation framesUncontrolled Resource Consumption · medium
    $2,58040 votes
75. http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacksUncontrolled Resource Consumption · high
    $3,49540 votes
76. curl cookie mixed case PSL bypassInformation Exposure Through Sent Data · medium
    $2,54040 votes
77. Rails ActionView sanitize helper bypass leading to XSS using SVG tag.Cross-site Scripting (XSS) - Generic · medium
    $2,40040 votes
78. mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full (CVE-2020-7065)Stack Overflow · high
    40 votes
79. Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crashUncontrolled Resource Consumption · high
    $3,64539 votes
80. Command Injection using malicious hostname in expanded proxycommandCode Injection · low
    $54039 votes
81. RCE via ssh:// URIs in multiple VCS OS Command Injection · high
    39 votes
82. Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucketMisconfiguration · medium
    38 votes
83. CVE-2024-2379: QUIC certificate check bypass with wolfSSLImproper Certificate Validation · low
    $56037 votes
84. CVE-2022-27774: Credential leak on redirectInsufficiently Protected Credentials · medium
    $2,40036 votes
85. Buffer overflow in req_parsebody method in lua_request.cHeap Overflow · high
    36 votes
86. Apache Airflow Sql injection by authenticated userSQL Injection · low
    $50535 votes
87. Unbounded memory growth with session handling in TLSv1.3Allocation of Resources Without Limits or Throttling · low
    $49735 votes
88. ACME TLS-SNI-01/02 challenge vulnerable when combined with shared hosting providersPrivilege Escalation · critical
    35 votes
89. PHP mbstring / Oniguruma multiple remote heap/stack corruptionsHeap Overflow · critical
    $1,50035 votes
90. Double free vulnerability in Flash Player Settings Manager (CVE-2015-0346)Memory Corruption - Generic
    $5,00035 votes
91. fs.fchown/fchmod bypasses permission modelInsecure Direct Object Reference (IDOR) · low
    $24934 votes
92. Argo CD CSRF leads to Kubernetes cluster compromiseCross-Site Request Forgery (CSRF) · high
    $4,66034 votes
93. [CVE-2023-38546] cookie injection with none fileMisconfiguration · low
    34 votes
94. DiffieHellman doesn't generate keys after setting a keyCryptographic Issues - Generic · medium
    $1,80034 votes
95. 1-byte heap buffer overflow in DNS resolverOff-by-one Error · medium
    34 votes
96. CVE-2024-49761: ReDoS vulnerability in REXMLUncontrolled Resource Consumption · medium
    33 votes
97. CVE-2024-25128: Apache Airflow: Authentication Bypass when Legacy OpenID(2.0) is in use as AUTH_TYPEImproper Authentication - Generic · medium
    33 votes
98. [CVE-2024-32464] ActionText ContentAttachment’s can Contain Unsanitized HTMLCross-site Scripting (XSS) - Stored · medium
    $2,60032 votes
99. CVE-2024-31079 in nginxStack Overflow · medium
    $2,60032 votes
100. Possible XSS Vulnerability in Action ControllerCross-site Scripting (XSS) - Generic · low
     $1,06832 votes