U.S. Dept Of Defense · disclosed reports
Access Control
71 disclosed reports · $0 paid · 70 valid · 1 duplicate
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open U.S. Dept Of Defense on HackerOne- reports
- 71
- valid
- 70
- paid a bounty
- 0
Every one of the 71 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Applicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.mil
- User automatically logged in as Sys Admin user on https://███/Administration/Administration.aspx
- Publicly Editable U.S. Air Force Google Spreadsheet Exposing Student Leave Data
- [█████████] Administrative access to Oracle WebLogic Server using default credentials
- Subdomain takeover ████████.mil
- Sensitive data exposure: █████████ candidate resumes/CVs available to download with no authentication through BAC/IDOR/Improper Salesforce config
- Unauthenticated Access to Admin Panel Functions at https://██████████/████████
- DoD workstation exposed to internet via TinyPilot KVM with no authentication
- 403 Forbidden Bypass at www.██████.mil
- [HTA2] Authorization Bypass on https://██████ leaks confidential aircraft/missile information
- [██████] Cross-origin resource sharing misconfiguration (CORS)
- EC2 subdomain takeover at http://████████/
- Automatic Admin Access
- Default Admin Username and Password on █████ Server at █████████mil
- Endpoint Redirects to Admin Page and Provides Admin role
- Docker Registry without authentication leads to docker images download
- Examples directory is PUBLIC on https://████████mil, leading to multiple vulns
- CVE-2021-39226 Discovered on endpoint https://██████/api/snapshots
- Information Disclosure FrontPage Configuration Information
- Leaks of username and password leads to CVE-2018-18862 exploitation
- Full account takeover on https://████████.mil
- Password Reset link hijacking via Host Header Poisoning leads to account takeover
- Default Admin Username and Password on ███
- Air Force candidate PII + recruitment chat logs accessible via BAC/IDOR on █████████ (very large/significant exposure)
- Subdomain takeover of ████
- Broken Authentication
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.