Issue with password change in Disabled Account #279914 Informative Misconfiguration and Insecure Design Low 2017-11-16 – 4 Reputation gain split by company can be used to track the existence of otherwise undisclosed reports #311449 N/A Information Disclosure Low 2018-02-02 – 4 Information Disclosure which violate program privacy #313075 Informative Information Disclosure Low 2018-02-20 – 5 Open redirect deceive in hackerone.com via another open redirect link. #296706 Informative Open Redirect Low 2017-12-13 – 7 Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spam #808755 Valid Input Validation and Logic Low 2020-05-15 – 7 Leakage badges on disabled user #325594 Informative Information Disclosure Low 2018-03-15 – 8 Information disclosure #350432 Duplicate Information Disclosure Low 2018-12-27 – 8 Information disclosure via policy update notifications after removal from program #177484 Valid Information Disclosure Low 2016-10-29 – 9 While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal) #307424 Informative Misconfiguration and Insecure Design Low 2018-01-23 – 10 Possible CSRF during external programs #174470 Valid Cross-Site Request Forgery Low 2016-10-18 – 12 javascript: and mailto: links are allowed in JIRA integration settings #209917 Duplicate Misconfiguration and Insecure Design Low 2017-04-10 – 12 Temporary banned user (from platform) is able to make submissions via embedded submission forms #1133536 Valid Input Validation and Logic Low 2021-09-22 – 12 Bypassing the External Link Warning #1139520 Valid Open Redirect Low 2021-05-07 – 14 CSV Injection at the CSV export feature #118582 Valid Command and Code Injection Low 2019-04-08 – 15 Researcher gets email updates on a private program after he/she quits that program. #174449 Valid Information Disclosure Low 2016-11-21 – 15 Moving a report to a different program doesn't reassign the Custom Field Values #511779 Valid Insecure Direct Object Reference Low 2019-04-25 – 15 Changes to data in a CVE request after draft via GraphQL query #813300 Valid Other weaknesses Low 2020-05-15 – 15 Invited team member can disclosure slack channels #509574 Valid Information Disclosure Low 2019-04-05 $500 16 Hackers can reveal the names of private programs that have an external link #1127455 Informative Information Disclosure Low 2021-08-24 – 16 Enumerating HackerOne Pentests #1139541 Informative Misconfiguration and Insecure Design Low 2021-08-25 – 16 PII data Leakage through hackerone reports #1256371 Valid Information Disclosure Low 2021-08-09 – 16 Previous attachments can be referenced when creating a new report #129773 Valid Misconfiguration and Insecure Design Low 2019-04-12 – 17 Race condition allows to send multiple times feedback for the hacker #1132171 Valid Race Conditions Low 2021-09-22 – 18 Names not completely redacted despite "Redact the names of the involved users" is selected #2122644 Valid Information Disclosure Low 2023-08-29 $500 18 Limited Open redirection using SSO-SAML #178345 Valid Open Redirect Low 2017-03-26 – 19 CSRF allows to test email forwarding #1131473 Valid Cross-Site Request Forgery Low 2021-05-13 – 19 Homograph attack in escalate report #143975 Valid Misconfiguration and Insecure Design Low 2019-04-19 – 20 Graphql: Sorting the reports by jira_status field resulted to different value #955286 Valid Access Control Low 2020-08-27 – 20 Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report #442843 Valid Access Control Low 2018-12-04 $500 21 HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension #1874260 Valid Cross-site Scripting Low 2023-02-14 – 21 Rounding errors on rewarding a bounty leads to bypassing the 20% H1 commission fee #808975 Valid Input Validation and Logic Low 2020-05-15 – 22 program_analytics_benchmarks query shows information not visible in public #826176 Valid Information Disclosure Low 2020-03-27 – 22 People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed #353310 Valid Information Disclosure Low 2018-06-25 $500 23 Self DOM-Based XSS in www.hackerone.com #406587 Valid Cross-site Scripting Low 2018-11-08 – 23 Hacker can request mediation for published reports #412988 Valid Access Control Low 2018-11-27 $500 23 Tab nabbing in Hackerone inbox. #1145563 Valid Open Redirect Low 2021-08-09 $500 23 report id is exposed for undisclosed reports in Hacktivity #493484 Informative Information Disclosure Low 2019-02-16 – 24 Disabled account can still use GraphQL endpoint #608656 Valid Access Control Low 2020-03-12 – 24 resolved bugs in a program are public despite the program settings #270993 Valid Information Disclosure Low 2017-10-13 – 25 SAML Response Reuse on hackerone.com/users/saml/auth #888930 Valid Authentication Low 2020-07-24 – 26 Report redaction doesn't apply to report title update activities #196358 Valid Misconfiguration and Insecure Design Low 2017-02-25 – 27 A user can request a report to be retested even though the program has not been verified by HackerOne #448078 Valid Access Control Low 2018-12-27 – 27 Private invitation links/tokens leak to third-party analytics site Analysed #1491127 Valid Information Disclosure Low 2022-04-05 $500 28 Information leakage via CSV when content is valid JavaScript Analysed #207266 Valid Cross-Site Request Forgery Low 2017-05-23 – 29 Submitting report through Embedded Submission form gives user indefinite access to a profile Analysed #463828 Valid Input Validation and Logic Low 2019-01-03 $500 29 Disclosure of h1 challenges name through the calendar Analysed #488643 Valid Information Disclosure Low 2019-01-30 – 29 Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation #981036 Informative Input Validation and Logic Low 2021-09-20 – 29 Dangling cloud instance at vpn.inverselink.com Analysed #1112679 Valid Input Validation and Logic Low 2021-03-11 $500 29 Editing Pentest Summary Report Answers After Submitting Them Analysed #1139528 Valid Other weaknesses Low 2021-05-06 – 29 Attachment references in markdown don't warn before downloading Analysed #1386277 Valid Open Redirect Low 2022-02-25 – 29