Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Flash-based XSS in cdnjs.cloudflare.com subdomain#9017 | No longer public | Cloudflare Vulnerability Disclosure | Cross-site Scripting | – | – | – | – |
| Cookie missing the Secure flag#9031 | No longer public | Cloudflare Vulnerability Disclosure | No weakness recorded | – | – | – | – |
| Sensitive settings need Re authentication#14698 | No longer public | WePay | Authentication | – | – | – | – |
| Open Redirect#14699 | No longer public | WePay | Open Redirect | – | – | $300 | – |
| Typical form vulnerable to csrf attack#14751 | No longer public | WePay | Cross-Site Request Forgery | – | – | – | – |
| oauth redirect uri validation bug leads to open redirect and account compromise#20661 | No longer public | WePay | Open Redirect | – | – | – | – |
| openssh-server Forced Command Handling Information Disclosure Vulnerability on blog.greenhouse.io#24984 | Valid | Greenhouse.io | Information Disclosure | – | 2014-10-10 | – | – |
| HTML form without CSRF protection at http://try.crashlytics.com/enterprise/#25128 | Valid | X / xAI | Cross-Site Request Forgery | – | 2014-10-02 | – | – |
| CSRF (Make email primary) may lead to account compromise#25405 | No longer public | WePay | Cross-Site Request Forgery | – | – | – | – |
| XSS via .eml file#26935 | No longer public | Mail.ru | Cross-site Scripting | – | 2014-12-10 | $1,337 | – |
| Horizontal Privilege Escalation#29420 | No longer public | WePay | Access Control | – | – | $350 | – |
| OPTIONS METHOD ENABLED#37102 | No longer public | Eobot | Misconfiguration and Insecure Design | – | – | – | – |
| Multiple information disclosure#37862 | No longer public | Eobot | Information Disclosure | – | – | – | – |
| Broken Authentication – Session Token bug#39203 | No longer public | WePay | Misconfiguration and Insecure Design | – | – | – | – |
| Unvalidated Redirects and Stored XSS#44739 | No longer public | Dropbox | Cross-site Scripting | – | – | – | – |
| Create N Accounts In Dropbox Irrespective Of Domain#49378 | No longer public | Dropbox | Memory Corruption | – | – | – | – |
| unknow files Upload in profile photo#52383 | No longer public | Dropbox Acquisitions | Misconfiguration and Insecure Design | – | – | – | – |
| XSS in https://hackpad.com/#53628 | No longer public | Dropbox Acquisitions | Cross-site Scripting | – | – | $216 | – |
| XSS in version history of an HTML file in a shared folder#56803 | No longer public | Dropbox | Cross-site Scripting | – | – | – | – |
| Escaping the iframe via exceptions#103989 | Valid | Khan Academy | Cross-site Scripting | – | 2015-12-29 | – | – |
| Null pointer dereference in phar_get_fp_offset()#103990 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-29 | $500 | – |
| Integer overflow in _Unpickler_Read#103992 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-26 | – | – |
| Request Hijacking Vulnerability In RubyGems 2.4.6 And Earlier#103993 | Valid | RubyGems | No weakness recorded | – | 2015-05-14 | – | – |
| Python 3.3 - 3.5 product_setstate() Out-of-bounds Read#103994 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-12 | $500 | – |
| Python xmlparse_setattro() Type Confusion#104000 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-07 | $500 | – |
| time_strftime() Buffer Over-read#104001 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-07 | $500 | – |
| Python scan_eol() Buffer Over-read#104002 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-03 | $500 | – |
| Python deque.index() uninitialized memory#104003 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-03 | $1,000 | – |
| Mem out-of-bounds write (segfault) in ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER#104004 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-02 | $500 | – |
| null pointer deref (segfault) in zend_eval_const_expr#104005 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-02 | $500 | – |
| Null pointer deref (segfault) in spl_autoload via ob_start#104006 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-23 | $500 | – |
| Buffer over-read in exif_read_data with TIFF IFD tag#104007 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-01 | $1,000 | – |
| Uninitialized pointer in phar_make_dirstream#104008 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-29 | $1,000 | – |
| SOAP serialize_function_call() type confusion / RCE#104010 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-02 | – | – |
| AddressSanitizer reports a global buffer overflow in mkgmtime() function#104011 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-10-15 | $500 | – |
| Integer overflow in unserialize() (32-bits only)#104012 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-10-15 | $500 | – |
| heap buffer overflow in enchant_broker_request_dict()#104013 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-01-26 | $500 | – |
| libcurl duphandle read out of bounds#104014 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-11-05 | $1,000 | – |
| curl_setopt_array() type confusion#104015 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-04 | – | – |
| Dangling pointer in the unserialization of ArrayObject items#104016 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-05 | $1,000 | – |
| Arbitrary code execution in str_ireplace function#104017 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-04 | – | – |
| Files extracted from archive may be placed outside of destination directory#104019 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-05 | – | – |
| audioop.lin2adpcm Buffer Over-read#104020 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-26 | $500 | – |
| audioop.adpcm2lin Buffer Over-read#104021 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-28 | $500 | – |
| hotshot pack_string Heap Buffer Overflow#104022 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-27 | $500 | – |
| bytearray.find Buffer Over-read#104023 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-29 | $1,000 | – |
| array.fromstring Use After Free#104024 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-07-25 | $500 | – |
| use after free in load_newobj_ex#104025 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-07-02 | $500 | – |
| invalid pointer free() in phar_tar_process_metadata()#104026 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-05-22 | $500 | – |
| Memory Corruption in phar_parse_tarfile when entry filename starts with null#104027 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-05-12 | $500 | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.