Notification of previous signed out user leakage. #26395 Informative Information Disclosure – 2014-09-01 – 2 Requesting unknown file type returns Ruby object w/ address #109420 Valid Information Disclosure – 2016-02-19 – 2 User with Read-Only permissions can manually public disclosure the report #118718 Valid Misconfiguration and Insecure Design – 2016-04-21 $500 2 User with Read-Only permissions can edit the SwagAwarded Activities on Bug Reports #118731 Valid Access Control – 2016-04-01 – 2 Denial of service in report view. #140720 Informative Denial of Service – 2016-05-27 – 2 Pending member invitations are not revoked on program name change #275293 Informative Information Disclosure – 2017-11-18 – 2 Potential denial of service in hackerone.com/teams/new #13748 Valid Denial of Service – 2014-06-20 – 3 Fake URL + Additional vectors for homograph attack #59469 Valid Misconfiguration and Insecure Design – 2015-05-09 – 3 External URL page bypass #63158 Valid No weakness recorded – 2015-05-28 – 3 Redirection Page throwing error instead of redirecting to site #67929 Valid Misconfiguration and Insecure Design – 2016-05-25 – 3 Internal bounty and swag details disclosed as part of JSON response #81083 Valid Information Disclosure – 2016-04-25 $500 3 Weak HSTS age in support hackerone site #86067 Valid Misconfiguration and Insecure Design – 2015-09-18 – 3 Hackerone impersonation #97377 Valid No weakness recorded – 2015-12-02 – 3 User with Read-Only permissions can request/approve public disclosure #109483 Valid Misconfiguration and Insecure Design – 2016-02-19 $500 3 Abusing HOF rankings in limited circumstances #118684 Informative Misconfiguration and Insecure Design – 2016-04-21 – 3 User with Read-Only permissions can edit the Internal comment Activities on Bug Reports After Revoke the team access permissions #119221 Valid Access Control – 2016-04-01 $500 3 SECURITY: Referencing previous Reports attachment_IDs on new Reports via Draft_Sync DELETES Attachments #123615 Valid Misconfiguration and Insecure Design – 2016-04-30 – 3 CSV Injection via the CSV export feature #124223 Valid Command and Code Injection – 2016-04-25 – 3 Reverse Tabnabbing Vulnerability in Outgoing Links #284143 Informative No weakness recorded – 2017-11-21 – 3 Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!) #3709 Valid Cryptography – 2014-04-22 – 4 Marking notifications as read CSRF bug #5946 Valid Cross-Site Request Forgery – 2015-04-28 – 4 (lack of) smtp transport layer security #6547 Informative Cryptography – 2015-05-05 – 4 Arbitrary file uploads to Amazon WS. #7929 Informative Misconfiguration and Insecure Design – 2014-04-26 – 4 Cache leads to Privacy leaks #17105 Valid Authentication – 2014-07-17 – 4 Denial of Service #17785 Valid Denial of Service – 2015-04-28 $100 4 Account Hijacking (Only rare case scenario) #21083 Informative Authentication – 2014-08-23 – 4 Window Opener Property Bug #27987 Valid No weakness recorded – 2014-10-28 – 4 Content Spoofing via reports #32137 Valid Misconfiguration and Insecure Design – 2016-05-25 – 4 Breaking Bugs as team member #38232 Valid Denial of Service – 2014-12-09 – 4 Reflected File Download attack allows attacker to 'upload' executables to hackerone.com domain #50658 Valid Command and Code Injection – 2015-04-16 – 4 Logic error with notifications: user that has left team continues to receive notifications and can not 'clean' this area on account #63729 Valid Misconfiguration and Insecure Design – 2015-06-04 $500 4 Number of invited researchers disclosed as part of JSON search response #80597 Valid Information Disclosure – 2015-08-05 – 4 Private Program and bounty details disclosed as part of JSON search response #80936 Valid Authentication – 2015-08-31 $500 4 Content spoofing on invitations page #92607 Valid No weakness recorded – 2015-10-21 – 4 HackerOne Private Programs users disclosure and de-anonymous-ize #92716 Informative Information Disclosure – 2015-12-08 – 4 Putting link inside link in markdown #115205 Valid Denial of Service – 2016-04-02 – 4 Distinguish EP+Private vs Private programs in HackerOne #118965 Valid Information Disclosure – 2016-04-25 – 4 Edit Auto Response Messages #123027 Valid Misconfiguration and Insecure Design – 2016-03-15 $1,000 4 Email Address Leak #123170 Duplicate Information Disclosure – 2016-03-31 – 4 Mediation link can be accepted by other users #123420 Valid Authentication – 2016-04-25 $500 4 Sending emails (via HackerOne) impersonating other users #123743 Valid Misconfiguration and Insecure Design – 2016-03-18 – 4 Disclosure of private programs that have an "external" page on HackerOne #124611 Valid Information Disclosure – 2016-04-01 – 4 Issue with password change in Disabled Account #279914 Informative Misconfiguration and Insecure Design – 2017-11-16 – 4 Reputation gain split by company can be used to track the existence of otherwise undisclosed reports #311449 N/A Information Disclosure – 2018-02-02 – 4 Issue with remember_user_token #7931 Valid Misconfiguration and Insecure Design – 2015-05-28 $150 5 Spamming any user from Reset Password Function #12782 N/A Misconfiguration and Insecure Design – 2016-05-03 – 5 Improper filtering of classes used in codeblocks in Markdown #12815 Valid Cross-site Scripting – 2014-07-08 – 5 No option to logout concurrent sessions #20122 Informative No weakness recorded – 2014-07-17 – 5 Issue with password change #38343 Valid Misconfiguration and Insecure Design – 2015-05-28 $500 5 URL Crashing browser. {Tested on firefox, Chrome and Safari} #39139 Valid Denial of Service – 2016-05-25 – 5