Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Two Error-Based SQLi in courses.aspx on ██████████#227102 | Valid | SQL Injection | Medium | 2019-12-02 | – | – |
| CUI labled and ████ Restricted pdf on █████#1243782 | Valid | Information Disclosure | Medium | 2021-08-26 | – | – |
| Sensitive information on '████████'#1300591 | Valid | Cryptography | Medium | 2021-08-26 | – | – |
| Access to admininstrative resources/account via path traversal#1326352 | Valid | File and Path Handling | Critical | 2022-09-06 | – | – |
| SQL injection found in US Navy Website (http://███/)#197755 | Valid | SQL Injection | Medium | 2019-12-02 | – | 1 |
| Access to job creation web page on http://████████#204996 | Valid | Misconfiguration and Insecure Design | Medium | 2019-12-02 | – | 1 |
| Content-Injection/XSS ████#205360 | Valid | Information Disclosure | Medium | 2019-12-02 | – | 1 |
| Cross-site scripting (XSS) vulnerability on a DoD website#208556 | Valid | Cross-site Scripting | Low | 2017-08-15 | – | 1 |
| [https://███] Local File Inclusion via graph.php#492767 | Valid | File and Path Handling | Medium | 2020-05-14 | – | 1 |
| SQL Injection - https://███/█████████/MSI.portal#674838 | Valid | SQL Injection | Medium | 2020-05-14 | – | 1 |
| [██████████] — Directory traversal via `/aerosol-bin/███████/display_directory_████_t.cgi`#686343 | Valid | File and Path Handling | Medium | 2020-05-14 | – | 1 |
| Publicly accessible Grafana install allows pivoting to Prometheus datasource#764731 | Valid | Information Disclosure | High | 2020-05-14 | – | 1 |
| Reflected XSS - in Email Input#799839 | Valid | Cross-site Scripting | Medium | 2022-03-18 | – | 1 |
| PulseSSL VPN Site with Compromised Creds @ ████#854049 | Valid | Information Disclosure | Critical | 2020-07-30 | – | 1 |
| SharePoint Web Services Exposed to Anonymous Access#920401 | Valid | Information Disclosure | Medium | 2020-11-24 | – | 1 |
| https://█████ is vulnerable to CVE-2020-3452 Read-Only Path Traversal Vulnerability#940384 | Valid | File and Path Handling | High | 2020-08-13 | – | 1 |
| Sensitive data exposure via https://████████.mil/secure/QueryComponent!Default.jspa - CVE-2020-14179#988550 | Valid | Information Disclosure | Medium | 2020-10-16 | – | 1 |
| Reflected XSS on https://█████#1103033 | Valid | Cross-site Scripting | Medium | 2021-03-11 | – | 1 |
| XSS Reflected on https://███ (███ parameter)#1143776 | Valid | Cross-site Scripting | Medium | 2021-07-29 | – | 1 |
| xss reflected on https://███████- (███ parameters)#1143783 | Valid | Cross-site Scripting | Medium | 2021-07-29 | – | 1 |
| RXSS ON https://██████████#1244145 | Valid | Cross-site Scripting | Medium | 2022-02-14 | – | 1 |
| CUI labled and ████ and ██████ Restricted ██████ intelligence#1244403 | Valid | Information Disclosure | Medium | 2021-08-19 | – | 1 |
| XSS on https://████████/████' parameter#1252020 | Valid | Cross-site Scripting | Medium | 2022-04-07 | – | 1 |
| XSS on https://███████/██████████ parameter#1252229 | Valid | Cross-site Scripting | Medium | 2022-04-07 | – | 1 |
| [CVE-2020-3452] Unauthenticated file read in Cisco ASA#1415825 | Valid | File and Path Handling | Critical | 2022-02-14 | – | 1 |
| CVE-2020-3452 on https://█████/#1455257 | Valid | File and Path Handling | High | 2022-03-18 | – | 1 |
| Arbitrary File Deletion (CVE-2020-3187) on ████████#1455266 | Valid | File and Path Handling | High | 2022-03-18 | – | 1 |
| ██████_log4j - https://██████#1631364 | Valid | Command and Code Injection | Critical | 2022-09-06 | – | 1 |
| solr_log4j - http://██████████#1631370 | Valid | Command and Code Injection | Critical | 2022-09-06 | – | 1 |
| Reflected XSS on a DoD website#183844 | Valid | Cross-site Scripting | Low | 2017-06-01 | – | 2 |
| SQL Injection vulnerability in a DoD website#197754 | Valid | SQL Injection | Medium | 2017-08-15 | – | 2 |
| Multiple cryptographic vulnerabilities in login page on ███████#223936 | Valid | Cryptography | Medium | 2019-12-02 | – | 2 |
| 2 vulnerabilities of arbitrary code in ████████ - CVE-2017-5929#272979 | Valid | Deserialization and Object Injection | Critical | 2019-10-08 | – | 2 |
| Unencrypted __VIEWSTATE parameter in a DoD website#423118 | Valid | Cryptography | Medium | 2020-05-14 | – | 2 |
| Padding Oracle ms10-070 in the a DoD website (https://██████/)#429966 | Valid | Cryptography | Medium | 2020-05-14 | – | 2 |
| █████ - Pre-generation of VIEWSTATE allows CAC bypass#496219 | Valid | Authentication | Critical | 2020-05-11 | – | 2 |
| Username&password is Disclosure in readme file in [https://█████████]#804980 | Valid | Information Disclosure | High | 2020-05-14 | – | 2 |
| Sensitive Information Leaking Through Navy Website. [█████]#812585 | Valid | Cryptography | High | 2020-05-14 | – | 2 |
| Stored XSS on ████████helpdesk#901799 | Valid | File and Path Handling | High | 2020-07-30 | – | 2 |
| RXSS Via URI Path - https://██████████/#984654 | Valid | Cross-site Scripting | Medium | 2021-10-18 | – | 2 |
| Access to Unclassified / FOUO Advanced Motion Platform of █████████.mil#1003455 | Valid | Access Control | Medium | 2020-11-02 | – | 2 |
| Reflected XSS - https://███#1260823 | Valid | Cross-site Scripting | Medium | 2021-07-29 | – | 2 |
| XSS due to CVE-2020-3580 [███]#1277389 | Valid | Cross-site Scripting | Medium | 2021-09-09 | – | 2 |
| [CVE-2021-29156 on ForgeRock OpenAm] LDAP Injection in Webfinger Protocol!#1278050 | Valid | Injection and Smuggling | Medium | 2021-08-19 | – | 2 |
| Sensitive data exposure via /secure/QueryComponent!Default.jspa endpoint on ████████#1278977 | Valid | Information Disclosure | Medium | 2022-04-29 | – | 2 |
| Sensitive information on ██████████#1300589 | Valid | Cryptography | Medium | 2021-08-26 | – | 2 |
| XSS because of Akamai ARL misconfiguration on ████#1305477 | Valid | Cross-site Scripting | Medium | 2022-03-18 | – | 2 |
| Information disclosure at '████████' --- CVE-2020-14179#1336397 | Valid | Information Disclosure | Medium | 2021-09-29 | – | 2 |
| ███ ████████ running a vulnerable log4j#1438393 | Valid | Memory Corruption | Critical | 2022-01-19 | – | 2 |
| CVE-2021-42567 - Apereo CAS Reflected XSS on https://█████████#1446236 | Valid | Cross-site Scripting | Medium | 2022-03-18 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.