浏览报告
607 份报告 · 本页赏金 $37,400 · 清除筛选
HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks身份认证HackerOne低危$2002026-10-08HackerOne Code sends live password-reset tokens to Segment in automatic page events身份认证HackerOne低危$2002026-09-24IDOR allows user to access report details via reference.json endpoint不安全的直接对象引用HackerOne高危$15,0002026-10-01Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql代码执行HackerOne中危$7,0002026-06-17`exportReportPdf` mutation shows internal Activity信息泄露HackerOne中危—2026-07-29Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse访问控制HackerOne低危—2026-03-18DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API其他弱点HackerOne未评级—2026-04-16Account takeover of existing HackerOne accounts through SCIM provisioning访问控制HackerOne中危—2025-07-17Residual Malicious Payloads on HackerOne after Vulnerability Fixes其他弱点HackerOne低危—2026-04-16Internal Access to Hackerone confluence Docs错误配置HackerOne中危$12,5002025-08-15The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present信息泄露HackerOne高危—2025-04-01Ability to access policy and updates for unauthorized program访问控制HackerOne低危—2025-05-08Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information信息泄露HackerOne低危—2025-05-31Hackerone supports accounts organitation takeover错误配置HackerOne低危$2,5002024-11-19Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation其他弱点HackerOne低危—2024-09-19Takeover of hackerone.engineering via Medium访问控制HackerOne低危—2024-11-14Bypass comment restriction访问控制HackerOne低危—2024-09-19IDOR Vulnerability at AddTagToAssets operation name不安全的直接对象引用HackerOne低危—2025-06-08Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member访问控制HackerOne低危—2024-12-24Bypassing HackerOne 2FA due to race condition业务逻辑HackerOne低危—2024-10-30TOTP Authenticator implementation Accepts Expired Codes身份认证HackerOne中危—2024-07-11Private data related to program exposed via /reports/<id>.json endpoint to external user participant信息泄露HackerOne低危—2024-08-30Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA身份认证HackerOne低危—2024-07-11Business Logic error leads to bypass 2FA requirement业务逻辑HackerOne中危—2024-07-11Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program访问控制HackerOne低危—2024-07-11
第 1 / 25 页下一页 →