U.S. Dept Of Defense · disclosed reports
Command and Code Injection
55 disclosed reports · $2,000 paid · 53 valid · 2 duplicate
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open U.S. Dept Of Defense on HackerOne- reports
- 55
- valid
- 53
- paid a bounty
- 2
Every one of the 55 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Public instance of Jenkins on https://██████████/ with /script enabled
- Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/
- [hta3] Remote Code Execution on ████
- LOGJ4 VUlnerability [HtUS]
- Remote Code Execution in ██████
- Remote Code Execution (RCE) in a DoD website
- RCE on █████ via CVE-2017-10271
- CVE-2020-7961 RCE Liferay Portal Unauthenticated via https://████████/
- Remote Code Execution through DNN Cookie Deserialization
- Log4Shell: RCE 0-day exploit on █████████
- RCE in ███ [CVE-2021-26084]
- RCE via File Upload with a Null Byte Truncated File Extension at https://██████/
- SQL injection my method -1 OR 3*2*1=6 AND 000159=000159
- Pulse Secure File disclosure, clear text and potential RCE
- Remote code execution on an Army website
- Unrestricted File Upload
- Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)
- Remote Code Execution (RCE) in a DoD website
- RCE on a Department of Defense website
- [███████] Remote Code Execution at ██████ [CVE-2021-44529] [HtUS]
- [hta3] Remote Code Execution on https://███ via improper access control to SCORM Zip upload/import
- Command Injection (via CVE-2019-11510 and CVE-2019-11539)
- Apache solr RCE via velocity template
- Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://███
CVE-2019-11508CVE-2019-11510CVE-2019-11538CVE-2019-11539CVE-2019-11540
- [CVE-2018-7600] Remote Code Execution due to outdated Drupal server on www.█████████
- Remote Code Execution on █████████
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.