Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Integer Underflow @ ossl_cipher_pkcs5_keyivgen#304115	Informative	Memory Corruption	–	2018-02-23	–	–
Invalid URL parsing '#'#341634	Informative	No weakness recorded	–	2018-05-01	–	–
SEGV in parse_rat()#363934	Informative	Denial of Service	–	2018-06-13	–	–
Response splitting vulnerability in WEBrick#153794	Valid	Cross-site Scripting	–	2018-04-29	–	4
Resolv::getaddresses bug that can be abused to bypass security measures.#287835	Informative	Misconfiguration and Insecure Design	–	2018-02-23	–	5
OpenSSL::X509::Name Equality Check Does Not Work, Patch included#387250	Valid	Cryptography	–	2018-10-19	–	11
controlled buffer under-read in pack_unpack_internal()#298246	Valid	Memory Corruption	–	2018-03-30	–	12
The possibility that unintended file operation may be performed because some methods of `Dir` do not check NULL characters.#302338	Valid	Access Control	–	2018-04-01	–	13
Unintentional file creation caused at Tempfile with directory traversal#302298	Valid	Access Control	–	2018-04-01	–	15
Unix domain socket and a path containing a null character#302997	Valid	Access Control	–	2018-03-31	–	17

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.