Skip to content
BackEsc
Sign in

AWS VDP · disclosed reports

Other weaknesses

24 disclosed reports · $0 paid · 23 valid · 1 duplicate

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.

Open AWS VDP on HackerOne
reports
24
valid
23
paid a bounty
0

Every one of the 24 is a mark on the map. Named now: 1 to 24, most upvoted first.

  1. Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#3022516AWS VDP · 75 votesValid
  2. Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration#3780277AWS VDP · 69 votesValid
  3. (Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#3014785AWS VDP · 56 votesValid
  4. Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#2981210AWS VDP · 50 votesValid
  5. Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#3009411AWS VDP · 45 votesValid
  6. Non-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration#3021451AWS VDP · 40 votesValid
  7. Non-Production API Endpoints for the bedrock-agent Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#2800091AWS VDP · 38 votesValid
  8. Non-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#2926361AWS VDP · 37 votesValid
  9. Session Timeout Does Not Enforce Re-Authentication on AWS Access Portal#2800511AWS VDP · 36 votesDuplicate
  10. Non-Production API Endpoints for the Device Farm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#2999116AWS VDP · 30 votesValid
  11. Amazon Comprehend Medical Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints#2979238AWS VDP · 29 votesValid
  12. Non-Production API Endpoint for the EventBridge Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration#3021618AWS VDP · 26 votesValid
  13. Non-Production API Endpoints for the bedrock Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#2951803AWS VDP · 25 votesValid
  14. AWS Auto Scaling Service Reporting "AWS Internal" for CloudTrail Events Generated from Specific Endpoints#3419587AWS VDP · 23 votesValid
  15. Non-Production API Endpoints for the Global Accelerator Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#3029552AWS VDP · 23 votesValid
  16. Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#2972435AWS VDP · 23 votesValid
  17. Non-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission Enumeration#3775702AWS VDP · 21 votesValid
  18. Non-Production API Endpoints for the Health Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#3042588AWS VDP · 21 votesValid
  19. Non-Production API Endpoints for the AI Ops Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration#3418966AWS VDP · 18 votesValid
  20. Amazon Pinpoint SMS and Voice, version 2 Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints#3072841AWS VDP · 18 votesValid
  21. Non-Production API Endpoints for the Glue Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#3031512AWS VDP · 18 votesValid
  22. Non-Production API Endpoints for the Neptune Graph Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#3068422AWS VDP · 17 votesValid
  23. Amazon Kendra Intelligent Ranking Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints#3044471AWS VDP · 16 votesValid
  24. Non-Production API Endpoints for the Route 53 Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration#3092085AWS VDP · 14 votesValid

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in