Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
[Rails42] We can inject HTML tags when server is using strip_tags method#81396	Valid	Cross-site Scripting	–	2016-03-13	–	3
DoS Attack in Controller Lookup Code#83962	Valid	Denial of Service	–	2016-03-13	–	3
Changeable model ids on vanilla update can lead to severely bad side-effects#63131	Informative	Misconfiguration and Insecure Design	–	2016-02-12	–	4
Potential XSS on sanitize/Rails::Html::WhiteListSanitizer#81212	Valid	Cross-site Scripting	–	2016-03-13	–	5
Validation bypass for Active Record and Active Model#108723	Valid	Misconfiguration and Insecure Design	Medium	2016-02-12	–	5
Data-Tags and the New HTML Sanitizer Subverts CSRF protection#42728	Valid	Cross-site Scripting	–	2016-03-13	–	6
Regarding [CVE-2016-0752] Possible Information Leak Vulnerability in Action View#113831	Valid	Command and Code Injection	–	2016-03-01	–	6
http_basic_authenticate_with is suseptible to timing attacks.#94568	Valid	Authentication	–	2016-03-13	–	7
Remote code execution using render :inline#113928	Valid	Command and Code Injection	–	2016-03-01	$1,500	7
Explicit, dynamic render path: Dir. Trav + RCE#46019	Valid	Command and Code Injection	High	2016-02-12	$500	9
Nested attributes reject_if proc can be circumvented by providing "_destroy" parameter#90457	Valid	No weakness recorded	High	2016-02-12	–	9

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.