Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow)#104028 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-18 | – | – |
| PyFloat_FromString & PyNumber_Long Buffer Over-reads#104032 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-11-08 | $1,000 | – |
| tokenizer crash when processing undecodable source code#104033 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-11-14 | – | – |
| directory listing in https://demo.owncloud.org/doc/#105149 | Valid | ownCloud | Information Disclosure | – | 2016-01-01 | – | – |
| libphutil: removing bytes from a PhutilRope does not work as intended#105657 | Valid | Phabricator | No weakness recorded | – | 2015-12-16 | – | – |
| Potential for Double Spend via Sign Message Utility#106315 | Informative | Coinbase | Cryptography | – | 2016-01-06 | – | – |
| Clickjacking : https://partners.cloudflare.com/#106362 | No longer public | Cloudflare Vulnerability Disclosure | Misconfiguration and Insecure Design | – | – | – | – |
| Format string vulnerability in zend_throw_or_error()#106548 | Valid | Internet Bug Bounty | Command and Code Injection | – | 2016-01-10 | $1,000 | – |
| [cfire.mail.ru] Time Based SQL Injection#107780 | No longer public | Mail.ru | SQL Injection | – | 2016-01-15 | $150 | – |
| [https://test1.owncloud.com/owncloud6/] Guessable password used for admin user#107849 | Valid | ownCloud | No weakness recorded | – | 2016-01-02 | – | – |
| otrs.owncloud.com: Reflected Cross-Site Scripting#108288 | Valid | ownCloud | Cross-site Scripting | – | 2016-02-10 | – | – |
| Mixed Active Scripting Issue on stats.owncloud.org#108692 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-02-06 | – | – |
| Directory Listing on grtp.co#109116 | Informative | Gratipay | Cryptography | – | 2017-08-21 | – | – |
| Use After Free in sortWithSortKeys()#109175 | Valid | Internet Bug Bounty | Memory Corruption | – | 2016-01-20 | $1,000 | – |
| Extended policy checks are buggy#109959 | Valid | Phabricator | No weakness recorded | – | 2016-01-11 | – | – |
| The csrf token remains same after user logs in#111262 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-02-25 | – | – |
| Stored XSS#112025 | Informative | Udemy | Cross-site Scripting | – | 2016-02-22 | – | – |
| owncloud.help: Text Injection#112304 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-01-23 | – | – |
| [afisha.mail.ru] SQL Injection#112555 | No longer public | Mail.ru | SQL Injection | – | 2016-02-01 | $300 | – |
| Stack overflow when decompressing tar archives#114024 | Valid | Internet Bug Bounty | Memory Corruption | – | 2019-11-12 | $500 | – |
| Remote Server Restart Lead to Denial of Server by only one Request.#114125 | No longer public | Keybase | Denial of Service | – | 2016-02-06 | $250 | – |
| XSS via modified Zomato widget (res_search_widget.php)#115402 | Valid | Eternal | Cross-site Scripting | – | 2016-03-11 | – | – |
| Full Path Disclosure in password lock#115422 | Informative | Paragon Initiative Enterprises | Information Disclosure | – | 2017-10-16 | – | – |
| nginx SPDY heap buffer overflow for https://grtp.co/#116352 | Informative | Gratipay | Memory Corruption | None | 2016-02-15 | – | – |
| Markdown parsing issue enables insertion of malicious tags#116512 | Informative | Gratipay | Cross-site Scripting | – | 2017-08-21 | – | – |
| proxy port 7000 and shell port 514 not filtered#116618 | Informative | Gratipay | Misconfiguration and Insecure Design | None | 2016-02-20 | – | – |
| server calendar and server status available to public#116621 | Informative | Gratipay | Information Disclosure | None | 2016-02-20 | – | – |
| UDP port 5060 (SIP) Open#116774 | Informative | Gratipay | Denial of Service | None | 2016-02-16 | – | – |
| MISSING SPF RECORDS & MISSING DKIM POLICY#117818 | Informative | LeaseWeb | Memory Corruption | – | 2016-02-22 | – | – |
| Full Path Disclosure In EasyDB#119494 | Informative | Paragon Initiative Enterprises | Information Disclosure | – | 2017-10-16 | – | – |
| Insecure transition from HTTP to HTTPS in form post#123915 | No longer public | New Relic | Information Disclosure | – | – | – | – |
| prevent %2f spoofed URLs in profile statement#128910 | Informative | Gratipay | Open Redirect | – | 2017-08-21 | – | – |
| Possible Blind SQL injection | Language choice in presentation#131047 | Informative | Gratipay | Misconfiguration and Insecure Design | – | 2017-08-21 | – | – |
| Submit a non valid syntax email#131053 | Informative | Gratipay | Misconfiguration and Insecure Design | – | 2017-08-21 | – | – |
| Reflected Cross Site scripting Attack (XSS)#150837 | No longer public | OLX | Cross-site Scripting | – | 2016-10-20 | – | – |
| integer overflow in the _csv module's join_append_data function#159686 | Valid | Internet Bug Bounty | No weakness recorded | – | 2019-11-12 | – | – |
| Usernames ending in .json are not restricted#161935 | Informative | Gratipay | Misconfiguration and Insecure Design | – | 2017-07-10 | – | – |
| x-xss protection header is not set in response header#162336 | Informative | Gratipay | Misconfiguration and Insecure Design | – | 2017-07-10 | – | – |
| Non-secure requests are not automatically upgraded to HTTPS#164419 | Informative | Legal Robot | No weakness recorded | – | 2017-12-19 | – | – |
| CSRF Issue#166231 | Informative | Legal Robot | Cross-Site Request Forgery | – | 2017-08-27 | – | – |
| Error Page Text Injection#176042 | Informative | Yelp | Misconfiguration and Insecure Design | None | 2017-11-09 | – | – |
| DOS in browser using window.print() function#176364 | Informative | Brave Software | Denial of Service | – | 2016-10-20 | – | – |
| XSS (Reflected)#176477 | No longer public | New Relic | Cross-site Scripting | – | – | – | – |
| Possible content spoofing due to missing error page#179021 | Informative | Yelp | Misconfiguration and Insecure Design | Low | 2017-11-09 | – | – |
| [Yelp Blog] Backslash in search string causes JS error#179732 | Informative | Yelp | Misconfiguration and Insecure Design | None | 2017-11-09 | – | – |
| Cookie Misconfiguration#180397 | No longer public | Boozt Fashion AB | Authentication | – | – | – | – |
| Not using Binary::safe* functions for substr/strlen function#181315 | Valid | Paragon Initiative Enterprises | No weakness recorded | – | 2016-11-13 | – | – |
| Moniter Failed Sends too many emails#194952 | No longer public | New Relic | No weakness recorded | – | – | – | – |
| Clickjacking @ Main Domain[www.yelp.com]#197115 | Informative | Yelp | Misconfiguration and Insecure Design | Low | 2017-11-09 | – | – |
| Information disclosue in Android Application#201855 | Duplicate | Coinbase | Denial of Service | Low | 2017-08-30 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.