Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
DRb denial of service vulnerability#898614	Informative	Denial of Service	–	2021-03-07	–	1
Command injection in OptionParser.load#1090678	N/A	Command and Code Injection	–	2021-03-07	–	1
Net::SMTP with tls allows forged certificates as long as the hostname matches#980249	Informative	Cryptography	–	2021-01-25	–	3
OS Command Injection in '/lib/un.rb -- Utilities to replace common UNIX commands in Makefiles etc'#1158824	Informative	Command and Code Injection	–	2021-07-19	–	4
OS Command Injection in 'rdoc' documentation generator#1161691	Valid	Command and Code Injection	–	2021-07-13	–	7
Code Injection Bug Report#745921	Valid	Command and Code Injection	–	2021-05-07	–	8
'net/ftp': Uncontrolled Resource Consumption (Memory/CPU)#1165748	Informative	Denial of Service	–	2021-04-21	–	8
lib/net/ftp.rb: trusting PASV responses allow client abuse#1145454	Valid	Information Disclosure	–	2021-07-08	–	9
imap: StartTLS stripping attack (CVE-2016-0772).#1178562	Valid	Cryptography	–	2021-07-08	–	10
Ruby OpenSSL Library - IV Reuse in GCM Mode#170548	Valid	No weakness recorded	–	2021-03-07	–	17
Round-trip instability in REXML#1104077	Valid	No weakness recorded	–	2021-04-15	–	20
Path traversal in Tempfile on windows OS due to unsanitized backslashes#1131465	Valid	File and Path Handling	–	2021-04-07	–	54

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.