Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| ClickJacking#183127 | Duplicate | Misconfiguration and Insecure Design | – | 2017-05-22 | – | 1 |
| invalid URL parsing with and '@'#184881 | N/A | Injection and Smuggling | – | 2017-05-22 | – | 2 |
| Subdomain Takeover on http://blog.owox.com/#184884 | Informative | Authentication | – | 2017-05-22 | – | 2 |
| Subdomain Takeover on OWOX.RU#186393 | Duplicate | Authentication | – | 2017-05-22 | – | 2 |
| Direct IP Access#183318 | N/A | Information Disclosure | – | 2017-05-22 | – | 4 |
| The URL in "Choose a data source'' at "https://bi.owox.com/ui/settings/connected-services/setup/" is not filtered => reflected XSS.#733051 | Valid | Cross-site Scripting | – | 2019-12-09 | – | 8 |
| Subdomain takeover in many subdomains#205949 | Valid | Access Control | – | 2017-03-24 | – | 9 |
| Subdomain Takeover on http://kiosk.owox.com/#182576 | Valid | Authentication | – | 2016-11-17 | – | 12 |
| Access to Grafana Dashboard#186586 | Valid | Information Disclosure | – | 2017-01-06 | – | 12 |
| HTTP Response Splitting(CRLF injection) in bi.owox.com#171473 | Valid | Command and Code Injection | – | 2016-12-20 | – | 13 |
| Unrestricted File Upload in Chat Window#925513 | Valid | Misconfiguration and Insecure Design | – | 2020-08-16 | – | 13 |
| Stored XSS at https://finance.owox.com/customer/accountList#192922 | Valid | Cross-site Scripting | – | 2017-02-12 | – | 16 |
| Broken Authentication & Session Management (Login Bypass) at support.owox.com#222082 | Valid | Authentication | – | 2017-05-22 | – | 17 |
| Session is not expire after logout#709378 | Valid | Authentication | – | 2019-11-08 | – | 17 |
| Server-side cache poisoning leads to the http://my.dev.owox.com inaccessibility#291012 | Valid | No weakness recorded | – | 2017-11-23 | – | 18 |
| Reflected XSS#732987 | Valid | Cross-site Scripting | – | 2019-12-09 | – | 20 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.