Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml #1028396 Valid Cross-site Scripting None 2021-03-26 – 32 Hackers can reveal the names of private programs that have an external link and Enterprise Product Edition #1130235 Valid Information Disclosure Low 2021-08-24 – 32 Private information exposed through GraphQL search endpoints aggregates #1838329 Valid Information Disclosure Medium 2023-01-19 – 32 Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program #2569993 Informative Access Control Low 2024-07-11 – 32 IDOR on Program Visibilty (Revealed / Concealed) against other team members #291721 Duplicate Insecure Direct Object Reference Medium 2017-11-23 – 33 Open Redirection in [https://www.hackerone.com/index.php] #562417 Valid Open Redirect None 2019-05-08 – 33 IDOR in Bugs overview enables attacker to determine the date range a hackathon was active #663431 Valid Insecure Direct Object Reference Low 2019-12-13 – 33 Lack warning label when receiving a letter #1128701 Valid Input Validation and Logic Low 2021-05-13 – 33 Internal machine learning API endpoint for CWE classification is vulnerable to path traversal #2032778 Valid File and Path Handling Medium 2023-07-05 – 33 Bypassing Two-Factor Authentication via Account Deactivation and Password Reset #2543342 Duplicate Access Control None 2024-07-11 – 33 Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation #2719622 Informative No weakness recorded Medium 2024-09-19 – 33 CSP not consistently applied #321 Valid Cross-site Scripting – 2013-11-30 – 34 Timing attack towards endpoints on the web without CSRF #348168 Duplicate Information Disclosure Low 2018-12-27 – 34 Accidental Access to Programs Information via SAML Login #438306 Valid No weakness recorded Critical 2018-11-14 – 34 Program Email Nofication settings ignored when being added as an external contributor #645264 Valid Information Disclosure Low 2019-08-07 – 34 Information leakage of private program #159526 Valid Information Disclosure – 2016-08-18 $500 35 Updating payout preference to CurrencyCloud doesn't notify user via email #240083 Valid Misconfiguration and Insecure Design None 2018-01-31 $500 35 [Bypass] Ability to invite a new member in sandbox Organization #1486417 Valid Input Validation and Logic Medium 2022-04-14 – 35 Broken Authentication and session management OWASP A2 #284 Valid Authentication – 2014-01-09 – 36 HackerOne Integrations Design Issue #172289 Valid Misconfiguration and Insecure Design Medium 2019-04-11 $500 36 Changing Victim's JIRA Integration Settings Through Multiple Bugs #226199 Valid Input Validation and Logic Medium 2017-05-23 $1,000 36 HackerOne reports escalation to JIRA is CSRF vulnerable #226418 Valid Cross-Site Request Forgery Medium 2017-08-30 $500 36 Invitation token leaks to https://bat.bing.com #301526 Valid Information Disclosure Low 2018-01-11 – 36 Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion Analysed #297181 Valid Misconfiguration and Insecure Design Low 2018-01-22 $500 37 User's who are banned from program can still be invited to the new reports as collaborators Analysed #1131306 Valid Input Validation and Logic Low 2021-09-22 – 37 Ability to bulk submit reports via query named based batching Analysed #2166697 Valid Misconfiguration and Insecure Design Low 2024-06-19 $500 37 Two-factor authentication bypass lead to information disclosure about the program and all hackers participate #2486086 Duplicate Information Disclosure High 2024-07-11 – 37 Reset the 2FA of the user which can lead to Account Takeover #2492631 Duplicate Access Control Medium 2024-07-11 – 37 Private program email forwarding response invitation not expire after first use. Analysed #209140 Valid Misconfiguration and Insecure Design High 2018-05-30 – 38 Report invitation links not restricted to any existing user Analysed #214839 Valid Information Disclosure Low 2017-05-23 $500 39 Team object in GraphQL that have a published external program may expose existence of a private program Analysed #347937 Valid Information Disclosure None 2018-07-04 – 39 Open redirect vulnerability in index.php Analysed #439075 Valid Open Redirect None 2019-02-03 – 39 Disclosure of Program email Title Report when being removed as contributor. Bypass for Report #645264 Analysed #669776 Valid Information Disclosure Low 2019-09-06 – 39 Private program disclosure through notifications Analysed #1234746 Valid Access Control Low 2021-08-05 $500 39 Business Logic error leads to bypass 2FA requirement #2571981 Duplicate Input Validation and Logic High 2024-07-11 – 39 HTML injection in email at https://www.hackerone.com/ Analysed #1374017 Valid Command and Code Injection Low 2023-05-12 – 40 DNS Cache Poisoning Analysed #487 Valid No weakness recorded – 2014-01-09 $100 41 Path traversal leading to limited CSRF on GET requests on two endpoints Analysed #301862 Valid No weakness recorded – 2019-04-05 – 41 User with privilege to maintain External Programs can update certain churned HackerOne programs Analysed #411930 Valid Access Control Low 2018-10-25 $500 41 The possibility of disrupting the normal operation of frontend using markdown Analysed #1138668 Valid Denial of Service Low 2021-08-24 – 41 Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs Analysed #1219011 Valid Information Disclosure Low 2021-06-30 $500 41 AWS S3 bucket writeable for authenticated aws users Analysed #128088 Valid Authentication – 2016-04-05 – 42 IE 11 Self-XSS on Jira Integration Preview Base Link Analysed #212721 Valid Cross-site Scripting Low 2017-03-29 $750 42 Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature Analysed #397031 Valid Information Disclosure Low 2018-11-07 – 42 User login page doesn't implement any form of rate limiting Analysed #410451 Valid Authentication Low 2019-01-04 – 42 GraphQL node interface for ActiveResource models lacks encoding for resource identifier, enabling parameter injection in Payments backend Analysed #800231 Valid Information Disclosure Medium 2020-05-11 – 42 HackerOne support disclosing report state without checking user identity Analysed #356566 Valid No weakness recorded Low 2018-06-02 $500 43 Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based" Analysed #427502 Valid Access Control Medium 2018-11-07 $2,500 43 Hackers two email disclosed on submission at hackerone hactivity Analysed #2134874 Valid Information Disclosure – 2023-10-18 – 43 Upload profile photo from URL Analysed #713 Valid Server-Side Request Forgery – 2014-02-15 – 44