Bug bounty program · HackerOne
U.S. Dept Of Defense
Most upvoted reports884
- #380103ValidStored Xss Vulnerability on ████████U.S. Dept Of Defense · Cross-site Scripting · 2020–192votes
- #768151ValidBypassing CORS Misconfiguration Leads to Sensitive ExposureU.S. Dept Of Defense · Input Validation and Logic · 2020–145votes
- #2950536ValidApplicant security exam Attachments/Documents accessible through an IDOR/BAC on the custom Apex controller on https://█████.milU.S. Dept Of Defense · Access Control · 2025 · Critical–142votes
- #768266ValidPublic instance of Jenkins on https://██████████/ with /script enabledU.S. Dept Of Defense · Command and Code Injection · 2020–118votes
- #2083771ValidRemote Code Execution and AWS IAM Credentials Exfiltration in https://████████/U.S. Dept Of Defense · Command and Code Injection · 2024 · Critical–114votes
- #1072832Valid[hta3] Remote Code Execution on ████U.S. Dept Of Defense · Command and Code Injection · 2023–104votes
- #1626205ValidWordpress Takeover using setup configuration at http://████.edu [HtUS]U.S. Dept Of Defense · Misconfiguration and Insecure Design · 2023$1,000102votes
- #2926447ValidPublic google drive link Exposes Military Orders Containing PII (Name, SSN etc..) and Operational DetailsU.S. Dept Of Defense · Information Disclosure · 2025 · Critical–99votes
- #2748003ValidLack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeoverU.S. Dept Of Defense · Information Disclosure · 2024 · Critical–98votes
- #227880ValidXXE in DoD website that may lead to RCEU.S. Dept Of Defense · Injection and Smuggling · 2019–97votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.