Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports #106084 Valid Authentication – 2015-12-29 $500 7 Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants #107336 Valid Access Control – 2016-01-27 – 7 Null byte injection #116189 Valid No weakness recorded – 2016-02-23 – 7 Deleted name still present via mouseover functionality for user accounts #127914 Valid Information Disclosure – 2016-04-21 – 7 Open redirect deceive in hackerone.com via another open redirect link. #296706 Informative Open Redirect Low 2017-12-13 – 7 Ajouter le même utilisateur que celui déjà inscrit dans les équipes #378209 Informative No weakness recorded – 2018-07-17 – 7 Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spam #808755 Valid Input Validation and Logic Low 2020-05-15 – 7 Report title autocompletion #263 Valid Information Disclosure – 2015-06-08 – 8 Autocomplete enabled in Paypal preferences #842 Valid Misconfiguration and Insecure Design – 2015-05-28 – 8 Weird Bug - Ability to see partial of other user's notification #2584 Valid No weakness recorded – 2014-04-19 – 8 Adding an user email address to the list before confirming. #3923 Informative Misconfiguration and Insecure Design – 2014-06-11 – 8 javascript: and mailto: links are allowed on users' profiles #4184 Valid Cross-site Scripting – 2015-05-13 – 8 Email changing #18846 Informative No weakness recorded – 2014-08-28 – 8 Redirect while opening links in new tabs #23386 Valid Open Redirect – 2014-09-12 $500 8 Ability to see common response titles of other teams (limited) #31383 Valid Information Disclosure – 2014-10-15 – 8 Logic Issue with Reputation: Boost Reputation Points #36211 Valid Misconfiguration and Insecure Design – 2015-04-28 – 8 Insecure Direct Object Reference vulnerability #46397 Valid Misconfiguration and Insecure Design – 2015-02-20 $500 8 Restrict any user from logging into his account. #48416 Valid Authentication – 2015-03-24 – 8 Information leakage - Private reports cached by Google #80118 Informative Information Disclosure – 2018-07-23 – 8 Increase number of bugs by sending duplicate of your own valid report #116951 Valid Misconfiguration and Insecure Design – 2016-04-25 – 8 External links should use rel="noopener" or use the redirect service #124620 Valid Open Redirect – 2016-04-05 – 8 External programs revealing info #124929 Valid Authentication – 2016-04-01 $1,500 8 Private Program all members disclosed #283309 Duplicate Information Disclosure – 2017-11-16 – 8 Leakage badges on disabled user #325594 Informative Information Disclosure Low 2018-03-15 – 8 Information disclosure #350432 Duplicate Information Disclosure Low 2018-12-27 – 8 Anti-MIME-Sniffing header X-Content-Type-Options header has not been set. #9479 Valid Misconfiguration and Insecure Design – 2015-04-28 – 9 Change Any username and profile link in hackerone #25281 Valid Access Control – 2014-09-25 $100 9 "early preview" programs disclosure #29185 Informative Information Disclosure – 2015-01-21 – 9 Reflected Filename Download #54034 Valid Command and Code Injection – 2016-04-25 – 9 Limited CSRF bypass. #99708 Valid Cross-Site Request Forgery – 2015-12-02 $500 9 Private program activity timeline information disclosure #116029 Valid Authentication – 2016-03-16 – 9 Reputation Manipulation (Theoretical) #132057 N/A Misconfiguration and Insecure Design – 2016-04-19 – 9 Disclosure of external users invited to a specific report #157699 Valid Information Disclosure – 2016-09-01 – 9 Information disclosure via policy update notifications after removal from program #177484 Valid Information Disclosure Low 2016-10-29 – 9 Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page #280770 Valid Information Disclosure None 2017-11-01 – 9 GraphQL sessions aren't immediately invalidated when user password is changed #283847 Valid Misconfiguration and Insecure Design – 2017-11-30 – 9 LinkedIN URL should be HTTPS #1093 Valid No weakness recorded – 2016-05-18 – 10 Session Hijacking attack (Different Scenario) #19640 Informative Authentication – 2014-07-17 – 10 Reflected File Download #39658 Valid Misconfiguration and Insecure Design – 2016-04-25 – 10 CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain #47472 Valid Cross-Site Request Forgery – 2015-02-26 $2,000 10 CSV Injection via the CSV export feature #111192 Valid Command and Code Injection – 2016-02-16 – 10 New hacktivity view discloses report IDs of non-public reports #127620 Valid Misconfiguration and Insecure Design – 2016-04-05 $500 10 Reward Money Leakage #149435 Informative Information Disclosure – 2016-08-09 – 10 Missing Password Confirmation at a Critical Function (Payout Method) #303299 Informative Misconfiguration and Insecure Design Medium 2018-01-10 – 10 While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal) #307424 Informative Misconfiguration and Insecure Design Low 2018-01-23 – 10 RTL override symbol not stripped from file names #298 Valid Misconfiguration and Insecure Design – 2015-05-28 – 11 Privilege escalation..., or not?! #345 Valid Misconfiguration and Insecure Design – 2015-06-08 – 11 Flawed account creation process allows registration of usernames corresponding to existing file names #477 Valid No weakness recorded – 2014-04-19 $100 11 A password reset page does not properly validate the authenticity token at the server side. #742 Valid Cross-Site Request Forgery – 2014-04-19 $100 11 All Active user sessions should be deleted when user change his password! #9950 Valid Misconfiguration and Insecure Design – 2016-04-25 $100 11