HTTPS is not enforced for objects stored by HackerOne on Amazon S3 #43280 Valid Misconfiguration and Insecure Design – 2015-03-08 – 5 Add text to the title of the page "Thanks" #44359 Valid Misconfiguration and Insecure Design – 2016-04-25 – 5 Improper way of validating a program #44888 Valid Cryptography – 2015-02-04 – 5 Team member invitations to sandboxed teams are not invalidated consistently #46429 Valid Authentication – 2015-03-28 $500 5 Substantially weakened authenticity verification when using 'Remember me for a week' #49357 Informative Cryptography – 2015-03-12 – 5 Missing spf flags for hackerone.com #57736 Valid Cryptography – 2015-04-23 – 5 Homograph attack #58612 Valid Misconfiguration and Insecure Design – 2015-05-02 – 5 Homograph Attack #59372 Valid Open Redirect – 2015-05-09 – 5 Content Spoofing - External Link Warning Page #60402 Valid Misconfiguration and Insecure Design – 2015-05-11 – 5 Email Notification should be get while changing Paypal Email #62827 Valid Authentication – 2015-06-19 – 5 Potential denial of service in hackerone.com/<program>/reward_settings #63865 Valid Denial of Service – 2015-06-10 – 5 mailto: link injection on https://hackerone.com/directory #66262 Valid Misconfiguration and Insecure Design – 2015-06-10 – 5 Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc. #90367 Valid Information Disclosure – 2015-09-25 – 5 Minimum bounty of a private program is visible for users that were removed from the program #94336 Valid Information Disclosure – 2015-10-21 – 5 attack in not an authorized user #111676 Valid Denial of Service – 2016-02-16 – 5 Private Program Disclosure in /:handle/settings/allow_report_submission.json endpoint #116798 Valid Information Disclosure – 2016-02-24 – 5 Possible XSS #123278 Informative Cross-site Scripting – 2016-04-21 – 5 HackerOne Important Emails Notification are sent in clear-text #127175 Valid Authentication – 2016-05-19 – 5 Information Disclosure which violate program privacy #313075 Informative Information Disclosure – 2018-02-20 – 5 harvesting attack on user registration #2193 Informative No weakness recorded – 2014-05-19 – 6 Securing sensitive pages from SearchBots #3986 Valid Misconfiguration and Insecure Design – 2014-04-20 – 6 creating titleless and non-closable bugs #6350 Valid No weakness recorded – 2014-04-17 – 6 Flooding mailbox of user #10109 Informative Misconfiguration and Insecure Design – 2014-04-30 – 6 Redirect FILTER bypass in report/comment #28865 Valid Open Redirect – 2014-10-19 $500 6 Enumeration/Guess of Private (Invited) Programs #32990 Valid Misconfiguration and Insecure Design – 2015-05-09 – 6 Markdown code block sequence makes report unreadable #46952 Valid No weakness recorded – 2015-06-29 – 6 Team member invitations to sandboxed teams are not invalidated consistently (v2) #48422 Valid Access Control – 2015-02-27 – 6 Auto Approval of Invitation to join Team as a Team member #49566 Valid Misconfiguration and Insecure Design – 2015-03-11 – 6 SPF whitelist of mandrill leads to email forgery #56742 Valid Authentication – 2015-06-08 – 6 Open-redirect on hackerone.com #57163 Valid Open Redirect – 2015-04-23 – 6 Making any Report Failed to load #59369 Valid Denial of Service – 2015-05-09 – 6 Reopen Disable Accounts/ Hidden Access After Disable #59659 Valid Authentication – 2015-06-08 – 6 Logical Issue (Boosting Reputation points) #60429 Informative No weakness recorded – 2015-07-21 – 6 Invitation is not properly cancelled while inviting to bug reports. #66151 Valid Authentication – 2015-07-10 – 6 Cross-domain AJAX request #97948 Valid Open Redirect – 2015-11-14 – 6 profile cover can also load external URL's #99687 Valid Misconfiguration and Insecure Design – 2015-12-02 – 6 Signals get affected once reports closed as self #108928 Valid Misconfiguration and Insecure Design – 2016-04-25 – 6 Multiple issues with Markdown and URL parsing #113070 Valid Misconfiguration and Insecure Design – 2016-04-21 $500 6 Private Program Disclosure in /:handle/reports/draft.json endpoint #116032 Valid Authentication – 2016-02-16 – 6 Denial of Service any Report #118663 Valid Denial of Service – 2016-03-09 – 6 Websites opened from reports can change url of report page #124889 Valid Cross-Site Request Forgery – 2016-04-21 – 6 New hacktivity view discloses report IDs of non-public reports #127235 Valid No weakness recorded – 2016-04-26 – 6 DOS Report FILE html inside <code> in markdown #127827 Valid Denial of Service – 2016-05-21 – 6 Partial disclosure of undisclosed programs through <meta> tags #302620 Informative Information Disclosure – 2018-01-11 – 6 CSV injection in the credentials export #1131887 Valid Misconfiguration and Insecure Design – 2021-09-22 – 6 Accepting Invalid characters on email address #3991 Valid Misconfiguration and Insecure Design – 2016-04-25 – 7 In markdown, parsing things like @danlec and #46072 after links is unsafe #46312 Valid No weakness recorded – 2015-07-04 – 7 "learn more here", reward email - domain expired. #52532 Valid Open Redirect – 2015-03-23 – 7 Accessing title of the report of which you are marked as duplicate #75556 Valid Authentication – 2015-07-17 $500 7 Send AJAX request to external domain #97191 Valid Cross-site Scripting – 2015-11-14 – 7