No email verification on username change #29331 Valid Information Disclosure – 2014-11-17 $500 11 CSRF possible when SOP Bypass/UXSS is available #103787 Valid Cross-Site Request Forgery – 2015-12-30 $2,500 11 Verbose PHP error messages exposed on a blog article #439174 Valid Information Disclosure None 2019-04-10 – 11 homograph attack. IDNs displayed in unicode in bug reports and on external link warning page #29491 Valid Misconfiguration and Insecure Design – 2014-10-09 $500 12 Open redirect in "Language change". #52035 Valid Open Redirect – 2015-06-19 $500 12 Improve signals in reputation #106305 Valid Misconfiguration and Insecure Design – 2016-01-07 – 12 Unauthorized Team members viewing #123572 Informative Authentication – 2016-07-02 – 12 Manipulate report timeline activity by using null byte. #133322 Informative Misconfiguration and Insecure Design – 2016-07-01 – 12 Possible CSRF during external programs #174470 Valid Cross-Site Request Forgery Low 2016-10-18 – 12 javascript: and mailto: links are allowed in JIRA integration settings #209917 Duplicate Misconfiguration and Insecure Design Low 2017-04-10 – 12 GitHub users outside of HackerOne organization can create and update Wiki pages of certain public HackerOne repositories #459634 Valid Input Validation and Logic None 2018-12-12 – 12 Temporary banned user (from platform) is able to make submissions via embedded submission forms #1133536 Valid Input Validation and Logic Low 2021-09-22 – 12 CSS leaks SCSS debug info #2221 Valid Information Disclosure – 2014-02-28 – 13 CSV Injection with the CVS export feature #72785 Valid Command and Code Injection – 2015-09-21 – 13 Requesting Mediation possible on reports that are too old for mediation #159512 Valid Access Control – 2016-08-17 – 13 Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA #2575079 Duplicate No weakness recorded Medium 2024-07-11 – 13 Session Management #288 Valid No weakness recorded – 2014-04-19 – 14 Control Characters Not Stripped From Username on Signup #3227 Valid Misconfiguration and Insecure Design – 2014-03-11 – 14 Gain reputation by creating a duplicate of an existing report #35237 Valid Misconfiguration and Insecure Design – 2015-08-14 – 14 Race Conditions Exist When Accepting Invitations #119354 Valid Misconfiguration and Insecure Design – 2016-04-26 – 14 Missing rate limit on critical user actions e.g. reset password, change email, disable account. #157750 Valid Access Control – 2019-04-11 – 14 Obtain the username & the uid of the one doing the S3 sync on Hackerone #173175 Valid Information Disclosure – 2016-10-03 – 14 Bypassing the External Link Warning #1139520 Valid Open Redirect Low 2021-05-07 – 14 Logical issues with account settings #546 Valid Misconfiguration and Insecure Design – 2015-05-28 – 15 Session not invalidated after password reset #15785 Valid Misconfiguration and Insecure Design – 2014-06-10 – 15 Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met) #17383 Valid Authentication – 2014-07-26 – 15 Pre-generation of 2FA secret/backup codes seems like an unnecessary risk #100509 Valid No weakness recorded – 2015-12-02 $1,000 15 Report title and issue information prepopulated #111868 N/A No weakness recorded – 2016-07-15 – 15 CSV Injection at the CSV export feature #118582 Valid Command and Code Injection Low 2019-04-08 – 15 Inadequate access controls in "Vote" functionality??? #137503 Valid Access Control – 2016-05-12 – 15 Able to remove the admin access of my program #141629 Valid Misconfiguration and Insecure Design – 2016-07-06 – 15 Researcher gets email updates on a private program after he/she quits that program. #174449 Valid Information Disclosure Low 2016-11-21 – 15 Lack of cross-origin request blocking allows leaking of sensitive information on several endpoints #350739 Duplicate Information Disclosure – 2018-06-07 – 15 Moving a report to a different program doesn't reassign the Custom Field Values #511779 Valid Insecure Direct Object Reference Low 2019-04-25 – 15 Changes to data in a CVE request after draft via GraphQL query #813300 Valid Other weaknesses Low 2020-05-15 – 15 Flawed account creation process allows registration of usernames corresponding to existing file names #275 Valid No weakness recorded – 2015-06-08 – 16 Password Reset Bug #8082 Valid Misconfiguration and Insecure Design – 2014-09-25 $100 16 Account takeover #17512 Informative Authentication – 2014-07-17 – 16 Markdown parsing issue enables insertion of malicious tags and event handlers #46916 Valid Cross-site Scripting – 2015-04-07 $5,000 16 Old titles are not hidden in reports with limited disclosure #144129 Valid Information Disclosure – 2016-06-21 – 16 Ability to monitor reports' submission in real time #159890 N/A Access Control – 2016-08-17 – 16 Users contents on AWS is cacheable #163131 Valid Information Disclosure – 2016-09-06 – 16 Submitted reports state logs leakage #306733 Informative Information Disclosure Medium 2018-01-19 – 16 Invited team member can disclosure slack channels #509574 Valid Information Disclosure Low 2019-04-05 $500 16 Hackers can reveal the names of private programs that have an external link #1127455 Informative Information Disclosure Low 2021-08-24 – 16 Enumerating HackerOne Pentests #1139541 Informative Misconfiguration and Insecure Design Low 2021-08-25 – 16 Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token. #1161141 Informative Information Disclosure Critical 2021-04-30 – 16 PII data Leakage through hackerone reports #1256371 Valid Information Disclosure Low 2021-08-09 – 16 File Name Enumeration #33935 Valid Information Disclosure – 2014-11-17 – 17 Homograph attack #59375 Valid Misconfiguration and Insecure Design – 2015-05-09 – 17