Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Integer Underflow @ ossl_cipher_pkcs5_keyivgen#304115	Informative	Memory Corruption	–	2018-02-23	–	–
Heap corruption in DateTime.strftime() on 32 bit for certain format strings#144484	Informative	Memory Corruption	–	2016-06-21	–	1
Heap corruption in string.c tr_trans() due to undersized buffer#144485	Informative	Memory Corruption	–	2016-06-21	–	2
Ruby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAML#235842	Valid	Memory Corruption	–	2017-10-25	–	3
Parsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfault#198927	Valid	Memory Corruption	–	2017-10-25	–	4
Ruby 2.4.1 has "Stack consistency error" and aborts when processing return statement within a case statement#247640	Informative	Memory Corruption	–	2017-09-24	–	4
Buffer underflow in sprintf#192127	Valid	Memory Corruption	–	2017-03-05	–	7
Arbitrary heap exposure in JSON.generate#209949	Valid	Memory Corruption	–	2017-09-25	–	9
controlled buffer under-read in pack_unpack_internal()#298246	Valid	Memory Corruption	–	2018-03-30	–	12
StringIO strio_getline() can divulge arbitrary memory#144482	Valid	Memory Corruption	–	2016-06-21	–	13
sprintf combined format string attack#212241	Valid	Memory Corruption	–	2017-09-22	–	18

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.