Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
The URL in "Choose a data source'' at "https://bi.owox.com/ui/settings/connected-services/setup/" is not filtered => reflected XSS.#733051	Valid	Cross-site Scripting	High	2019-12-09	–	8
Subdomain takeover in many subdomains#205949	Valid	Access Control	Critical	2017-03-24	–	9
Subdomain Takeover on http://kiosk.owox.com/#182576	Valid	Authentication	Critical	2016-11-17	–	12
Access to Grafana Dashboard#186586	Valid	Information Disclosure	Medium	2017-01-06	–	12
HTTP Response Splitting(CRLF injection) in bi.owox.com#171473	Valid	Command and Code Injection	–	2016-12-20	–	13
Unrestricted File Upload in Chat Window#925513	Valid	Misconfiguration and Insecure Design	Medium	2020-08-16	–	13
Stored XSS at https://finance.owox.com/customer/accountList#192922	Valid	Cross-site Scripting	Low	2017-02-12	–	16
Broken Authentication & Session Management (Login Bypass) at support.owox.com#222082	Valid	Authentication	Critical	2017-05-22	–	17
Session is not expire after logout#709378	Valid	Authentication	Medium	2019-11-08	–	17
Server-side cache poisoning leads to the http://my.dev.owox.com inaccessibility#291012	Valid	No weakness recorded	High	2017-11-23	–	18
Reflected XSS#732987	Valid	Cross-site Scripting	High	2019-12-09	–	20

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,444 analysed so far), which can be wrong. Data as of 2026-11-15.