Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:Informatica
Status
Severity
Weakness
Year
Bounty paid0
Access stated
Access needed
  • No account0
  • A user account0
  • A privileged role0
  • Admin0
  • Physical or local access0
  • Not clear from the report0
Clear filters68 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
Missing SPF for informatica.com#39250InformativeMisconfiguration and Insecure Design–2015-01-12–1
XSS in Search Communities Function#47235ValidCross-site Scripting–2015-07-31–1
[community.informatica.com] - CSRF in Private Messages allows to move user's messages to Trash#45050ValidCross-Site Request Forgery–2016-03-02–3
[wave.informatica.com]- Subdomain missconfiguration#205034ValidMisconfiguration and Insecure Design–2017-02-19–3
Reflected Cross-Site Scripting/HTML Injection#1379158ValidCross-site Scripting–2021-12-17–3
[kb.informatica.com] Unauthenticated emails and HTML injection in email messages#139402ValidCross-Site Request Forgery–2016-11-28–4
[marketplace.informatica.com] Profile stored XSS#190217ValidCross-site Scripting–2017-04-19–4
[https://life.informatica.com] - information disclose#312292ValidInformation Disclosure–2019-07-12–4
[now.informatica.com] Reflective XSS#106678ValidCross-site Scripting–2016-12-09–5
[marketplace.informatica.com] Open Redirect#123625ValidOpen Redirect–2016-06-27–5
[careers.informatica.com] XSS on "isJTN"#190020ValidCross-site Scripting–2017-04-07–5
[marketplace.informatica.com] Search XSS#200034ValidCross-site Scripting–2017-05-22–5
[marketplace.informatica.com]- Stored XSS on Image title and Edit Property#202951ValidCross-site Scripting–2017-04-21–5
[informatica.com]- Information Disclosure#204239ValidInformation Disclosure–2018-09-05–5
[now.informatica.com] Reflective Xss#81191ValidCross-site Scripting–2016-05-19–6
[doc.rt.informaticacloud.com] Reflected XSS via Stack Strace#232320ValidCross-site Scripting–2022-07-23–6
Unrestricted file upload - cloudacademy.informatica.com#253202ValidNo weakness recorded–2017-12-01–6
[marketplace.informatica.com]-Reflected XSS#266801ValidCross-site Scripting–2017-12-15–6
[marketplace.informatica.com] - Stored XSS#277259ValidCross-site Scripting–2017-12-15–6
jira discloser information#994612ValidInformation Disclosure–2022-10-03–6
XXE at Informatica sub-domain#150520ValidCommand and Code Injection–2018-04-30–7
[kb.informatica.com] Stored XSS#170369ValidCross-site Scripting–2017-04-09–7
[network.informatica.com] The login form XSS via the referer value#190016ValidCross-site Scripting–2017-05-22–7
accounts.informatica.com - RCE due to exposed Groovy console#672243ValidCommand and Code Injection–2019-08-14–7
[parc.informatica.com] Reflected Cross Site Scripting and Open Redirect#178278ValidCross-site Scripting–2017-04-29–8
[marketplace.informatica.com] Persistent XSS through document title#181816ValidCross-site Scripting–2017-02-02–8
Cisco RCE#411270ValidCommand and Code Injection–2018-09-21–8
[product360.informatica.com] Unauthenticated Apache Tomcat 8 Installation#146436ValidInformation Disclosure–2016-12-08–9
Stored XSS via Discussion Title and Send as Email attribute in [marketplace.informatica.com]#203912ValidCross-site Scripting–2017-04-08–9
[http://www.informatica.com]- info disclosure#311058ValidInformation Disclosure–2018-02-26–9
SSRF on infawiki.informatica.com and infawikitest.informatica.com#327480ValidServer-Side Request Forgery–2018-08-16–9
F5 BIG-IP Cookie potentially reveal BigIP pool name, backend's IP address and port, routed domain.#1211094ValidInformation Disclosure–2021-06-28–9
[careers.informatica.com] Cross Site Script Vulnerability on informatica#42537ValidCross-site Scripting–2017-05-10–10
[uk.informatica.com] XSS on uk.informatica..com#143323ValidCross-site Scripting–2017-02-28–10
[alpha.informatica.com] Expensive DOMXSS#158749ValidCross-site Scripting–2017-07-08–10
[afocusp.informatica.com] Sql injection afocusp.informatica.com:37777#178632ValidSQL Injection–2017-01-21–10
[kb.informatica.com] DOM based XSS in the bindBreadCrumb function#189834ValidCross-site Scripting–2017-06-24–10
[ipm.informatica.com]- Broken Authentication#201152ValidAuthentication–2017-04-11–10
[informatica.com]- Cross Site scripting#204237ValidCross-site Scripting–2017-10-30–10
[marketplace.informatica.com] - Sensitive Data Exposure#270695ValidInformation Disclosure–2017-12-18–10
[informatica.com] Blind SQL Injection#117073ValidSQL Injection–2016-04-19–11
[marketplace.informatica.com] User email disclosure#230608ValidInformation Disclosure–2017-11-07–11
loing in to marketplace panel on enablement.informatica.com#1081750ValidAuthentication–2021-01-20–11
[marketplace.informatica.com] - XXE#106802ValidCommand and Code Injection–2016-12-09–12
[rev-app.informatica.com] - XXE via SAML#106865ValidCommand and Code Injection–2016-12-09–12
[marketplace.informatica.com] - Template Injection#299241ValidCommand and Code Injection–2018-01-02–12
Cross site scripting#1095797ValidCross-site Scripting–2021-05-17–12
CVE-2021-40870 in [███]#1360593ValidCommand and Code Injection–2021-11-15–12
RXSS in http://procurement-businesscatalog.informatica.com#831803ValidCross-site Scripting–2020-03-27–13
[marketplace.informatica.com] - XXE#106797ValidCommand and Code Injection–2016-12-09–14

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.

Updated AboutDevelopersSign in