Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
XSS in http://www.rockstargames.com/theballadofgaytony/js/jquery.base.jsAnalysed#242905	Valid	Cross-site Scripting	Medium	2017-07-17	–	28
Image Injection/XSS vulnerability affecting https://www.rockstargames.com/newswire/articleAnalysed#790465	Valid	Cross-Site Request Forgery	Medium	2020-06-24	–	29
DOM Based xss on https://www.rockstargames.com/ ( 1 )Analysed#475442	Valid	Cross-site Scripting	High	2020-06-12	–	34
Image Injection vulnerability on screenshot-viewer/responsive/image may allow Facebook OAuth token theft.Analysed#655288	Valid	Information Disclosure	Medium	2020-06-24	–	36
Smuggle SocialClub's Facebook OAuth Code via Referer LeakageAnalysed#342709	Valid	Information Disclosure	Medium	2018-10-23	$750	39
Exposed CDN access token allows modification of all newly uploaded Snapmatic photosAnalysed#2184872	Valid	Access Control	Medium	2024-01-26	–	41
Insecure Direct Object Reference allows Crew Invite deletionAnalysed#1947924	Valid	Insecure Direct Object Reference	Medium	2023-08-17	–	67
Unserialize leading to arbitrary PHP function invokeAnalysed#210741	Valid	Command and Code Injection	Critical	2017-12-13	–	119
Stealing Facebook OAuth Code Through Screenshot viewerAnalysed#488269	Valid	Information Disclosure	Medium	2019-03-05	–	200

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.