Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| User with Read-Only permissions can manually public disclosure the report#118718 | Valid | Misconfiguration and Insecure Design | – | 2016-04-21 | $500 | 2 |
| Fake URL + Additional vectors for homograph attack#59469 | Valid | Misconfiguration and Insecure Design | – | 2015-05-09 | – | 3 |
| Redirection Page throwing error instead of redirecting to site#67929 | Valid | Misconfiguration and Insecure Design | – | 2016-05-25 | – | 3 |
| Weak HSTS age in support hackerone site#86067 | Valid | Misconfiguration and Insecure Design | – | 2015-09-18 | – | 3 |
| User with Read-Only permissions can request/approve public disclosure#109483 | Valid | Misconfiguration and Insecure Design | – | 2016-02-19 | $500 | 3 |
| Abusing HOF rankings in limited circumstances#118684 | Informative | Misconfiguration and Insecure Design | – | 2016-04-21 | – | 3 |
| SECURITY: Referencing previous Reports attachment_IDs on new Reports via Draft_Sync DELETES Attachments#123615 | Valid | Misconfiguration and Insecure Design | – | 2016-04-30 | – | 3 |
| Arbitrary file uploads to Amazon WS.#7929 | Informative | Misconfiguration and Insecure Design | – | 2014-04-26 | – | 4 |
| Content Spoofing via reports#32137 | Valid | Misconfiguration and Insecure Design | – | 2016-05-25 | – | 4 |
| Logic error with notifications: user that has left team continues to receive notifications and can not 'clean' this area on account#63729 | Valid | Misconfiguration and Insecure Design | – | 2015-06-04 | $500 | 4 |
| Edit Auto Response Messages#123027 | Valid | Misconfiguration and Insecure Design | – | 2016-03-15 | $1,000 | 4 |
| Sending emails (via HackerOne) impersonating other users#123743 | Valid | Misconfiguration and Insecure Design | – | 2016-03-18 | – | 4 |
| Issue with password change in Disabled Account#279914 | Informative | Misconfiguration and Insecure Design | – | 2017-11-16 | – | 4 |
| Issue with remember_user_token#7931 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | $150 | 5 |
| Spamming any user from Reset Password Function#12782 | N/A | Misconfiguration and Insecure Design | – | 2016-05-03 | – | 5 |
| Issue with password change#38343 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | $500 | 5 |
| HTTPS is not enforced for objects stored by HackerOne on Amazon S3#43280 | Valid | Misconfiguration and Insecure Design | – | 2015-03-08 | – | 5 |
| Add text to the title of the page "Thanks"#44359 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | – | 5 |
| Homograph attack#58612 | Valid | Misconfiguration and Insecure Design | – | 2015-05-02 | – | 5 |
| Content Spoofing - External Link Warning Page#60402 | Valid | Misconfiguration and Insecure Design | – | 2015-05-11 | – | 5 |
| mailto: link injection on https://hackerone.com/directory#66262 | Valid | Misconfiguration and Insecure Design | – | 2015-06-10 | – | 5 |
| Securing sensitive pages from SearchBots#3986 | Valid | Misconfiguration and Insecure Design | – | 2014-04-20 | – | 6 |
| Flooding mailbox of user#10109 | Informative | Misconfiguration and Insecure Design | – | 2014-04-30 | – | 6 |
| Enumeration/Guess of Private (Invited) Programs#32990 | Valid | Misconfiguration and Insecure Design | – | 2015-05-09 | – | 6 |
| Auto Approval of Invitation to join Team as a Team member#49566 | Valid | Misconfiguration and Insecure Design | – | 2015-03-11 | – | 6 |
| profile cover can also load external URL's#99687 | Valid | Misconfiguration and Insecure Design | – | 2015-12-02 | – | 6 |
| Signals get affected once reports closed as self#108928 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | – | 6 |
| Multiple issues with Markdown and URL parsing#113070 | Valid | Misconfiguration and Insecure Design | – | 2016-04-21 | $500 | 6 |
| CSV injection in the credentials export#1131887 | Valid | Misconfiguration and Insecure Design | – | 2021-09-22 | – | 6 |
| Accepting Invalid characters on email address#3991 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | – | 7 |
| Autocomplete enabled in Paypal preferences#842 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 8 |
| Adding an user email address to the list before confirming.#3923 | Informative | Misconfiguration and Insecure Design | – | 2014-06-11 | – | 8 |
| Logic Issue with Reputation: Boost Reputation Points#36211 | Valid | Misconfiguration and Insecure Design | – | 2015-04-28 | – | 8 |
| Insecure Direct Object Reference vulnerability#46397 | Valid | Misconfiguration and Insecure Design | – | 2015-02-20 | $500 | 8 |
| Increase number of bugs by sending duplicate of your own valid report#116951 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | – | 8 |
| Anti-MIME-Sniffing header X-Content-Type-Options header has not been set.#9479 | Valid | Misconfiguration and Insecure Design | – | 2015-04-28 | – | 9 |
| Reputation Manipulation (Theoretical)#132057 | N/A | Misconfiguration and Insecure Design | – | 2016-04-19 | – | 9 |
| GraphQL sessions aren't immediately invalidated when user password is changed#283847 | Valid | Misconfiguration and Insecure Design | – | 2017-11-30 | – | 9 |
| Reflected File Download#39658 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | – | 10 |
| New hacktivity view discloses report IDs of non-public reports#127620 | Valid | Misconfiguration and Insecure Design | – | 2016-04-05 | $500 | 10 |
| Missing Password Confirmation at a Critical Function (Payout Method)#303299 | Informative | Misconfiguration and Insecure Design | – | 2018-01-10 | – | 10 |
| While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal)#307424 | Informative | Misconfiguration and Insecure Design | – | 2018-01-23 | – | 10 |
| RTL override symbol not stripped from file names#298 | Valid | Misconfiguration and Insecure Design | – | 2015-05-28 | – | 11 |
| Privilege escalation..., or not?!#345 | Valid | Misconfiguration and Insecure Design | – | 2015-06-08 | – | 11 |
| All Active user sessions should be deleted when user change his password!#9950 | Valid | Misconfiguration and Insecure Design | – | 2016-04-25 | $100 | 11 |
| homograph attack. IDNs displayed in unicode in bug reports and on external link warning page#29491 | Valid | Misconfiguration and Insecure Design | – | 2014-10-09 | $500 | 12 |
| Improve signals in reputation#106305 | Valid | Misconfiguration and Insecure Design | – | 2016-01-07 | – | 12 |
| Manipulate report timeline activity by using null byte.#133322 | Informative | Misconfiguration and Insecure Design | – | 2016-07-01 | – | 12 |
| javascript: and mailto: links are allowed in JIRA integration settings#209917 | Duplicate | Misconfiguration and Insecure Design | – | 2017-04-10 | – | 12 |
| Control Characters Not Stripped From Username on Signup#3227 | Valid | Misconfiguration and Insecure Design | – | 2014-03-11 | – | 14 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.