Requesting unknown file type returns Ruby object w/ address #109420 Valid Information Disclosure – 2016-02-19 – 2 User with Read-Only permissions can manually public disclosure the report #118718 Valid Misconfiguration and Insecure Design – 2016-04-21 $500 2 User with Read-Only permissions can edit the SwagAwarded Activities on Bug Reports #118731 Valid Access Control – 2016-04-01 – 2 Potential denial of service in hackerone.com/teams/new #13748 Valid Denial of Service – 2014-06-20 – 3 Fake URL + Additional vectors for homograph attack #59469 Valid Misconfiguration and Insecure Design – 2015-05-09 – 3 External URL page bypass #63158 Valid No weakness recorded – 2015-05-28 – 3 Redirection Page throwing error instead of redirecting to site #67929 Valid Misconfiguration and Insecure Design – 2016-05-25 – 3 Internal bounty and swag details disclosed as part of JSON response #81083 Valid Information Disclosure – 2016-04-25 $500 3 Weak HSTS age in support hackerone site #86067 Valid Misconfiguration and Insecure Design – 2015-09-18 – 3 Hackerone impersonation #97377 Valid No weakness recorded – 2015-12-02 – 3 User with Read-Only permissions can request/approve public disclosure #109483 Valid Misconfiguration and Insecure Design – 2016-02-19 $500 3 User with Read-Only permissions can edit the Internal comment Activities on Bug Reports After Revoke the team access permissions #119221 Valid Access Control – 2016-04-01 $500 3 SECURITY: Referencing previous Reports attachment_IDs on new Reports via Draft_Sync DELETES Attachments #123615 Valid Misconfiguration and Insecure Design – 2016-04-30 – 3 CSV Injection via the CSV export feature #124223 Valid Command and Code Injection – 2016-04-25 – 3 Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!) #3709 Valid Cryptography – 2014-04-22 – 4 Marking notifications as read CSRF bug #5946 Valid Cross-Site Request Forgery – 2015-04-28 – 4 Cache leads to Privacy leaks #17105 Valid Authentication – 2014-07-17 – 4 Denial of Service #17785 Valid Denial of Service – 2015-04-28 $100 4 Window Opener Property Bug #27987 Valid No weakness recorded – 2014-10-28 – 4 Content Spoofing via reports #32137 Valid Misconfiguration and Insecure Design – 2016-05-25 – 4 Breaking Bugs as team member #38232 Valid Denial of Service – 2014-12-09 – 4 Reflected File Download attack allows attacker to 'upload' executables to hackerone.com domain #50658 Valid Command and Code Injection – 2015-04-16 – 4 Logic error with notifications: user that has left team continues to receive notifications and can not 'clean' this area on account #63729 Valid Misconfiguration and Insecure Design – 2015-06-04 $500 4 Number of invited researchers disclosed as part of JSON search response #80597 Valid Information Disclosure – 2015-08-05 – 4 Private Program and bounty details disclosed as part of JSON search response #80936 Valid Authentication – 2015-08-31 $500 4 Content spoofing on invitations page #92607 Valid No weakness recorded – 2015-10-21 – 4 Putting link inside link in markdown #115205 Valid Denial of Service – 2016-04-02 – 4 Distinguish EP+Private vs Private programs in HackerOne #118965 Valid Information Disclosure – 2016-04-25 – 4 Edit Auto Response Messages #123027 Valid Misconfiguration and Insecure Design – 2016-03-15 $1,000 4 Mediation link can be accepted by other users #123420 Valid Authentication – 2016-04-25 $500 4 Sending emails (via HackerOne) impersonating other users #123743 Valid Misconfiguration and Insecure Design – 2016-03-18 – 4 Disclosure of private programs that have an "external" page on HackerOne #124611 Valid Information Disclosure – 2016-04-01 – 4 Issue with remember_user_token #7931 Valid Misconfiguration and Insecure Design – 2015-05-28 $150 5 Improper filtering of classes used in codeblocks in Markdown #12815 Valid Cross-site Scripting – 2014-07-08 – 5 Issue with password change #38343 Valid Misconfiguration and Insecure Design – 2015-05-28 $500 5 URL Crashing browser. {Tested on firefox, Chrome and Safari} #39139 Valid Denial of Service – 2016-05-25 – 5 HTTPS is not enforced for objects stored by HackerOne on Amazon S3 #43280 Valid Misconfiguration and Insecure Design – 2015-03-08 – 5 Add text to the title of the page "Thanks" #44359 Valid Misconfiguration and Insecure Design – 2016-04-25 – 5 Improper way of validating a program #44888 Valid Cryptography – 2015-02-04 – 5 Team member invitations to sandboxed teams are not invalidated consistently #46429 Valid Authentication – 2015-03-28 $500 5 Missing spf flags for hackerone.com #57736 Valid Cryptography – 2015-04-23 – 5 Homograph attack #58612 Valid Misconfiguration and Insecure Design – 2015-05-02 – 5 Homograph Attack #59372 Valid Open Redirect – 2015-05-09 – 5 Content Spoofing - External Link Warning Page #60402 Valid Misconfiguration and Insecure Design – 2015-05-11 – 5 Email Notification should be get while changing Paypal Email #62827 Valid Authentication – 2015-06-19 – 5 Potential denial of service in hackerone.com/<program>/reward_settings #63865 Valid Denial of Service – 2015-06-10 – 5 mailto: link injection on https://hackerone.com/directory #66262 Valid Misconfiguration and Insecure Design – 2015-06-10 – 5 Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc. #90367 Valid Information Disclosure – 2015-09-25 – 5 Minimum bounty of a private program is visible for users that were removed from the program #94336 Valid Information Disclosure – 2015-10-21 – 5 attack in not an authorized user #111676 Valid Denial of Service – 2016-02-16 – 5