CSRF login #547 Valid Cross-Site Request Forgery – 2014-01-13 – 24 Improper session management #737 Valid Authentication – 2014-02-19 $100 24 Information disclosure (reset password token) and changing the user's password #738 Valid Cross-Site Request Forgery – 2014-02-19 $100 24 Hackerone Email Addresses Enumeration #2429 Informative Information Disclosure – 2016-06-17 – 24 Ability to enumerate private programs using SAML #167828 Valid Information Disclosure – 2016-09-14 – 24 Transitioning a Private Program to Public Does Not Clear Previously Private Updates to Hackers #210190 Valid Information Disclosure Medium 2017-04-05 $500 24 User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program #350964 Valid Information Disclosure None 2018-06-27 – 24 report id is exposed for undisclosed reports in Hacktivity #493484 Informative Information Disclosure Low 2019-02-16 – 24 Disabled account can still use GraphQL endpoint #608656 Valid Access Control Low 2020-03-12 – 24 Lack of input sanitization in Marketo form leads to execution of HTML in lead emails #220009 Valid Server-Side Request Forgery – 2017-10-03 $500 25 resolved bugs in a program are public despite the program settings #270993 Valid Information Disclosure Low 2017-10-13 – 25 Information Disclosure when /invitations/<token>.json is not yet accepted #290930 Valid Information Disclosure Medium 2019-12-06 – 25 Unicorn worker pool exhaustion by continuously updating payout preferences #317543 Valid Denial of Service Medium 2018-03-30 – 25 Stored Cross-Site Scripting vulnerability in example Custom Digital Agreement #983077 Valid Cross-site Scripting Medium 2021-03-18 – 25 2fa can't be activated on app.pullrequest.com #2463069 Informative Misconfiguration and Insecure Design None 2024-07-11 – 25 SAML Response Reuse on hackerone.com/users/saml/auth #888930 Valid Authentication Low 2020-07-24 – 26 Switching the user to the attacker's account #727 Valid Cross-Site Request Forgery – 2014-02-20 $150 27 Report redaction doesn't apply to report title update activities #196358 Valid Misconfiguration and Insecure Design Low 2017-02-25 – 27 Able To Check The Exact Bounty Balance of any Bug Bounty Program #293593 Duplicate Information Disclosure Medium 2017-12-06 – 27 Program profile_metrics.json contains time to triage for deptofdefense even it's turned off #318399 Valid Information Disclosure None 2018-03-09 $250 27 A user can request a report to be retested even though the program has not been verified by HackerOne #448078 Valid Access Control Low 2018-12-27 – 27 Email spoofing #575 Valid Misconfiguration and Insecure Design – 2015-05-28 – 28 Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session #111968 Valid Open Redirect – 2016-02-24 – 28 Can read features from any user #316810 Valid Information Disclosure Medium 2018-03-12 $250 28 Private invitation links/tokens leak to third-party analytics site #1491127 Valid Information Disclosure Low 2022-04-05 $500 28 Session Not Expire / 2FA Bypass #2469706 Informative Authentication Medium 2024-07-11 – 28 2FA Bypass via Leaked Cookies #2479622 Informative Authentication Medium 2024-07-11 – 28 Information leakage via CSV when content is valid JavaScript #207266 Valid Cross-Site Request Forgery Low 2017-05-23 – 29 Program profile metrics endpoint contains mean time to triage, even when turned off #289568 Valid Information Disclosure Medium 2017-11-14 – 29 Submitting report through Embedded Submission form gives user indefinite access to a profile #463828 Valid Input Validation and Logic Low 2019-01-03 $500 29 Disclosure of h1 challenges name through the calendar #488643 Valid Information Disclosure Low 2019-01-30 – 29 Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation #981036 Informative Input Validation and Logic Low 2021-09-20 – 29 Dangling cloud instance at vpn.inverselink.com #1112679 Valid Input Validation and Logic Low 2021-03-11 $500 29 Editing Pentest Summary Report Answers After Submitting Them #1139528 Valid Other weaknesses Low 2021-05-06 – 29 Attachment references in markdown don't warn before downloading #1386277 Valid Open Redirect Low 2022-02-25 – 29 Ability to escape database transaction through SQL injection, leading to arbitrary code execution #1663299 Valid SQL Injection High 2022-08-09 – 29 Non-secure requests are not automatically upgraded to HTTPS #158186 Valid No weakness recorded – 2016-08-19 – 30 Blind SSRF in "Integrations" by abusing a bug in Ruby's native resolver. #287245 Valid Server-Side Request Forgery – 2017-11-09 – 30 CSRF at [Apply to this program] that lead to submit your request automatic with out any validations #334253 Valid Misconfiguration and Insecure Design Low 2018-07-05 – 30 A small set of users were assigned someone else's payout preference #498845 Valid Information Disclosure Low 2019-02-20 – 30 HackerOne Pentesters can access any structured scope object through GraphQL node interface #781150 Valid Access Control High 2020-03-11 – 30 A team member of the program with Report rights can ban the Admin #816143 Valid Input Validation and Logic Low 2020-05-15 – 30 Read-only team members can read all properties of webhooks #818848 Valid Access Control Low 2020-04-29 – 30 Information disclosure - Feedback is accessible on Public profile even after 'disallowed' at https://hackerone.com/settings/feedback #1264725 Valid Information Disclosure Low 2021-08-03 – 30 Improper Authentication - 2FA OTP Reusable #2529780 Duplicate Authentication High 2024-07-11 – 31 RCE in profile picture upload #135072 Valid Command and Code Injection – 2016-06-08 – 32 Invitation tokens leak to Google Analytics #237262 Valid Information Disclosure Low 2017-07-16 – 32 View Any Program's Team Members through GET https://hackerone.com/invitations/ #283014 Valid Information Disclosure Medium 2017-11-01 $1,000 32 Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties #395518 Valid Information Disclosure Low 2018-08-17 – 32 Attacker can claim credentials for private program that has a published external program #449680 Valid Information Disclosure Medium 2018-11-29 – 32