Private program name disclosure in the invitation mail for another program Analysed #2228413 Valid Information Disclosure Low 2023-12-08 – 58 Report Private Links Leaks to Google Analytics via Query String Param Analysed #269479 Valid Information Disclosure Medium 2017-10-25 – 59 Team object exposes amount of participants in a private program to non-invited users Analysed #380317 Valid Information Disclosure Medium 2018-07-20 – 59 Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects Analysed #781175 Valid Access Control Medium 2020-03-20 – 59 Stored XSS on https://events.hackerone.com Analysed #1028332 Valid Cross-site Scripting None 2021-03-26 – 59 HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information Analysed #378122 Valid Information Disclosure None 2018-07-26 – 60 TeamProfile exposes partially sensitive information through GraphQL Analysed #389600 Valid Information Disclosure Low 2018-08-08 – 60 Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint Analysed #2357012 Valid No weakness recorded Medium 2024-05-24 – 60 Query parameter reordering causes redirect page to render unsafe URL Analysed #293689 Valid Cross-site Scripting Medium 2017-11-30 $1,500 61 LLM03: Training Data Poisoning via ASCII decoding #2370955 Informative Injection and Smuggling None 2024-05-28 – 61 View any user email using the Team's audit log section #2404415 Duplicate Information Disclosure Critical 2024-03-26 – 61 Parameter pollution in social sharing buttons Analysed #105953 Valid Misconfiguration and Insecure Design – 2015-12-19 $500 62 Disclosure of Email title report in quick award paypout email (no content mode) Analysed #689997 Valid Information Disclosure Low 2019-10-11 $500 62 "package_name" can be set as desired when submitting a Pentest Opportunity form Analysed #2431495 Valid Access Control Medium 2024-06-19 – 63 Takeover of hackerone.engineering via Medium Analysed #2709660 Valid Authentication Low 2024-11-14 – 63 Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile Analysed #347693 Valid Information Disclosure Medium 2018-05-08 $2,500 64 Partial report contents leakage - via HTTP/2 concurrent stream handling Analysed #493176 Valid Information Disclosure Medium 2021-08-05 $2,500 64 Second-order SOQL injection through email and campaign name parameter in Salesforce lead submission Analysed #1039821 Valid No weakness recorded Low 2021-06-18 – 64 Hackers can find out the ID of private programs Analysed #1129649 Valid Information Disclosure Low 2021-08-24 – 64 Minor security issue with Hackerone Invitations from sandbox program Analysed #2430179 Valid Input Validation and Logic Low 2024-07-22 – 64 HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms Analysed #298265 Valid No weakness recorded None 2018-03-13 – 65 Any user with access to program can resume and suspend HackerOne Gateway Analysed #717716 Valid Insecure Direct Object Reference Medium 2019-10-21 – 65 Pixel flood attack Analysed #390 Valid Denial of Service – 2013-11-30 $500 66 Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering Analysed #1132606 Valid Information Disclosure Medium 2021-08-24 – 66 Private program disclosure of `██████████` through notifications Analysed #1179241 Valid Access Control Low 2021-06-09 $500 66 Private draft report exposure in a program a user is added as a viewer to Analysed #2552205 Valid Information Disclosure Medium 2024-09-17 $2,500 66 Inline banner on Report page discloses whether organization runs a private program Analysed #452973 Valid Information Disclosure Low 2018-12-11 $500 67 IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs Analysed #510759 Valid Insecure Direct Object Reference Low 2019-09-06 – 67 Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery #2501984 Informative Authentication Critical 2024-07-11 – 67 Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeover Analysed #514451 Valid Server-Side Request Forgery None 2019-04-04 $500 68 Non Org Admin/Group Manager can create groups in an organization Analysed #2372018 Valid Access Control High 2024-07-23 – 68 Private data related to program exposed via /reports/<id>.json endpoint to external user participant #2580982 Informative Information Disclosure Medium 2024-08-30 – 68 Homograph fix Bypass Analysed #271324 Valid Misconfiguration and Insecure Design Medium 2017-10-16 – 71 The request tells the number of private programs, the new system of authorization /invite/token Analysed #310946 Valid Information Disclosure Medium 2018-02-14 $2,000 71 Potential stored Cross-Site Scripting vulnerability in Support Backend Analysed #858894 Valid Cross-site Scripting Medium 2020-05-04 – 71 The hacker has access to the administrative part of the management reports in publish report Analysed #867249 Valid No weakness recorded Low 2020-12-16 $500 71 Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS. Analysed #929361 Valid Information Disclosure Low 2020-10-02 – 71 Team object in GraphQL disclosed of private programs via the industry Analysed #707406 Valid No weakness recorded Low 2019-11-23 $500 72 Race condition in joining CTF group Analysed #1540969 Valid Race Conditions Low 2023-01-08 $500 72 Being able to disclose IBB bounty table of any public program Analysed #2322082 Valid Information Disclosure Medium 2024-03-17 – 72 Residual Malicious Payloads on HackerOne after Vulnerability Fixes Analysed #3168691 Valid Input Validation and Logic Medium 2026-04-16 – 72 Race condition leads to duplicate payouts Analysed #220445 Valid Access Control Low 2017-05-23 – 73 Validation message in Bounty award endpoint can be used to determine program balances Analysed #293299 Valid Information Disclosure Medium 2017-11-29 – 73 Pentester can obtain information about other pentesters who applied for the same test, but weren't accepted Analysed #958374 Valid Information Disclosure Low 2020-08-24 $500 74 A HackerOne employee's GitHub personal access token exposed in Travis CI build logs Analysed #215625 Valid Information Disclosure Medium 2017-05-23 $2,000 75 Team object in GraphQL discloses team group names and permissions Analysed #343464 Valid Information Disclosure Medium 2018-05-04 $2,500 75 Usernames still visible on report export pdf despite "I want to redact all usernames" is selected Analysed #2054222 Valid Information Disclosure Low 2023-08-08 $500 75 Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?) Analysed #170310 Valid Misconfiguration and Insecure Design None 2016-12-08 – 76 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid Insecure Direct Object Reference Medium 2019-10-25 – 76 Any organization's assets pending review can be downloaded Analysed #1787644 Valid Information Disclosure High 2022-11-29 – 76