Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:U.S. Dept Of Defense
Status
Severity
Weakness:File and Path Handling
Clear
Year
Bounty paid1
Access stated
Access needed
Technique
Clear filters52 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
Access to admininstrative resources/account via path traversal#1326352ValidFile and Path HandlingCritical2022-09-06––
[https://███] Local File Inclusion via graph.php#492767ValidFile and Path HandlingMedium2020-05-14–1
[██████████] — Directory traversal via `/aerosol-bin/███████/display_directory_████_t.cgi`#686343ValidFile and Path HandlingMedium2020-05-14–1
https://█████ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability#940384ValidFile and Path HandlingHigh2020-08-13–1
[CVE-2020-3452] Unauthenticated file read in Cisco ASA#1415825ValidFile and Path HandlingCritical2022-02-14–1
CVE-2020-3452 on https://█████/#1455257ValidFile and Path HandlingHigh2022-03-18–1
Arbitrary File Deletion (CVE-2020-3187) on ████████#1455266ValidFile and Path HandlingHigh2022-03-18–1
Stored XSS on ████████helpdesk#901799ValidFile and Path HandlingHigh2020-07-30–2
https://██████/ Vulnerable to CVE-2013-3827 (Directory-traversal vulnerability)#1280188ValidFile and Path HandlingMedium2021-08-26–3
[CVE-2020-3452] Unauthenticated file read in Cisco ASA#1555021ValidFile and Path HandlingHigh2022-05-12–3
Directory Traversal at █████#1641148ValidFile and Path HandlingHigh2022-09-14–3
[██████████.mil] Cisco VPN Service Path Traversal#943717ValidFile and Path HandlingHigh2020-10-16–4
[CVE-2020-3452] Unauthenticated file read in Cisco ASA#951530ValidFile and Path HandlingHigh2020-10-16–4
Read-only path traversal (CVE-2020-3452) at https://████████#959679ValidFile and Path HandlingHigh2021-04-02–4
Read-only path traversal (CVE-2020-3452) at https://█████#960082ValidFile and Path HandlingHigh2021-04-02–4
[CVE-2020-3452] Unauthenticated file read in Cisco ASA#1555015ValidFile and Path HandlingHigh2022-05-12–4
https://█████████ Vulnerable to CVE-2018-0296 Cisco ASA Path Traversal Authentication Bypass#622864ValidFile and Path HandlingHigh2019-10-04–6
Read-only path traversal (CVE-2020-3452) at https://██████.mil#962908ValidFile and Path HandlingHigh2021-04-02–6
Path traversal on [███]#1212746ValidFile and Path HandlingHigh2021-10-13–6
[CVE-2020-3452] on ███████#1234925ValidFile and Path HandlingHigh2022-04-07–6
CVE-2020-3187 - Unauthenticated Arbitrary File Deletion#1555027ValidFile and Path HandlingCritical2022-05-12–6
[CVE-2018-0296] Cisco VPN path traversal on the https://1████████ (https://████████.███.████████/)#694861ValidFile and Path HandlingMedium2024-07-19–9
CVE-2020-3452, unauthenticated file read in Cisco ASA & Cisco Firepower.#951508ValidFile and Path HandlingHigh2020-09-03–9
CVE-2020-3187 - Unauthenticated Arbitrary File Deletion#1555025ValidFile and Path HandlingCritical2022-05-12–9
File upload vulnerability on a DoD website#191243ValidFile and Path HandlingMedium2017-03-16–10
[CVE-2019-11510 ] Path Traversal on ████████ leads to leaked passwords, RCE, etc#671857ValidFile and Path HandlingCritical2019-12-02–10
[CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (██████)#695776ValidFile and Path HandlingMedium2024-07-19–10
[CVE-2018-0296] Cisco VPN path traversal on the https://████████/ (no hostname)#695780ValidFile and Path HandlingMedium2024-07-19–10
[CVE-2018-0296] Cisco VPN path traversal on the https://████████/ (█████████.mil)#696400ValidFile and Path HandlingMedium2024-06-18–10
Unauthenticated Arbitrary File Deletion ("CVE-2020-3187") in ████████#978335ValidFile and Path HandlingCritical2020-09-29–10
Unauthenticated Arbitrary File Deletion "CVE-2020-3187" in █████#1026265ValidFile and Path HandlingCritical2020-11-23–10
lfi in filePathDownload parameter via ███████#1542734ValidFile and Path HandlingHigh2022-04-29–10
https://████ is vulnerable to cve-2020-3452#998925ValidFile and Path HandlingCritical2021-05-11–11
Path Traversal - [ CVE-2020-3452 ]#1137321ValidFile and Path HandlingHigh2021-05-11–11
Local File Read vulnerability on ██████████ [HtUS]#1624670ValidFile and Path HandlingHigh2023-01-06$50011
Path traversal on ████████#217344ValidFile and Path HandlingHigh2019-10-04–12
Local File Inclusion In Registration Page#1007799ValidFile and Path HandlingHigh2020-11-23–12
Local file read at https://████/ [HtUS]#1626210ValidFile and Path HandlingCritical2022-10-14–12
Path traversal leads to reading of local files on ███████ and ████#1888808ValidFile and Path HandlingHigh2023-03-24–12
[Critical] Full local fylesystem access (LFI/LFD) as admin via Path Traversal in the misconfigured Java servlet on the https://███/#497771ValidFile and Path HandlingHigh2019-10-04–14
Unrestricted File Upload Leads to XSS & Potential RCE#900179ValidFile and Path HandlingHigh2020-07-08–15
[CVE-2018-0296] Cisco VPN path traversal on the https://██████████#694865ValidFile and Path HandlingMedium2024-06-18–16
Arbitrary File Read at ███ via filename parameter#1436223ValidFile and Path HandlingCritical2022-02-14–16
[CVE-2018-0296] Cisco VPN path traversal on the https://███ (████████████████)#695427ValidFile and Path HandlingMedium2024-07-19–17
███ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability#959187ValidFile and Path HandlingHigh2020-09-03–18
[CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (████.███.mil)#695429ValidFile and Path HandlingMedium2024-06-18–19
Path traversal on https://███ allows arbitrary file read (CVE-2020-3452)#936399ValidFile and Path HandlingHigh2020-08-13–20
Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)Analysed#696276ValidFile and Path HandlingHigh2024-06-18–31
Unathenticated file read (CVE-2020-3452)Analysed#2233418ValidFile and Path HandlingHigh2023-11-17–36
LFI with potential to RCE on ██████ using CVE-2019-3396Analysed#538771ValidFile and Path HandlingHigh2019-10-04–58

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.