Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Pippo XML Entity Expansion (Billion Laughs Attack)#506791	Informative	Other weaknesses	–	2019-06-10	–	1
Repositories of datanucleus are fetched over insecure protocol (http insted of https)#879740	Valid	Cryptography	–	2020-10-05	–	1
c3p0 may be exploited by a Billion Laughs Attack when loading XML configuration#509315	Valid	Other weaknesses	–	2019-04-16	–	5
Unsafe deserialization in Nexus Repository helm plugin#917843	Valid	Deserialization and Object Injection	–	2020-09-10	–	5
OS Command Injection in Nexus Repository Manager 2.x -- Bypass for Nexus Repository Manage 2.14.15-01 Command Injection fix#724599	Valid	Command and Code Injection	–	2020-06-29	–	7
Unrestricted File Upload Leading to Remote Code Execution#683965	Valid	Input Validation and Logic	–	2019-10-30	–	12
OS Command Injection in Nexus Repository Manager 2.x#654888	Valid	Command and Code Injection	–	2019-08-20	–	28
OS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475)#688270	Valid	Command and Code Injection	–	2019-10-29	–	34

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.