Fake URL + Additional vectors for homograph attack #59469 Valid Misconfiguration and Insecure Design – 2015-05-09 – 3 External URL page bypass #63158 Valid No weakness recorded – 2015-05-28 – 3 Weak HSTS age in support hackerone site #86067 Valid Misconfiguration and Insecure Design – 2015-09-18 – 3 Hackerone impersonation #97377 Valid No weakness recorded – 2015-12-02 – 3 Marking notifications as read CSRF bug #5946 Valid Cross-Site Request Forgery – 2015-04-28 – 4 (lack of) smtp transport layer security #6547 Informative Cryptography – 2015-05-05 – 4 Denial of Service #17785 Valid Denial of Service – 2015-04-28 $100 4 Reflected File Download attack allows attacker to 'upload' executables to hackerone.com domain #50658 Valid Command and Code Injection – 2015-04-16 – 4 Logic error with notifications: user that has left team continues to receive notifications and can not 'clean' this area on account #63729 Valid Misconfiguration and Insecure Design – 2015-06-04 $500 4 Number of invited researchers disclosed as part of JSON search response #80597 Valid Information Disclosure – 2015-08-05 – 4 Private Program and bounty details disclosed as part of JSON search response #80936 Valid Authentication – 2015-08-31 $500 4 Content spoofing on invitations page #92607 Valid No weakness recorded – 2015-10-21 – 4 HackerOne Private Programs users disclosure and de-anonymous-ize #92716 Informative Information Disclosure – 2015-12-08 – 4 Issue with remember_user_token #7931 Valid Misconfiguration and Insecure Design – 2015-05-28 $150 5 Issue with password change #38343 Valid Misconfiguration and Insecure Design – 2015-05-28 $500 5 HTTPS is not enforced for objects stored by HackerOne on Amazon S3 #43280 Valid Misconfiguration and Insecure Design – 2015-03-08 – 5 Improper way of validating a program #44888 Valid Cryptography – 2015-02-04 – 5 Team member invitations to sandboxed teams are not invalidated consistently #46429 Valid Authentication – 2015-03-28 $500 5 Substantially weakened authenticity verification when using 'Remember me for a week' #49357 Informative Cryptography – 2015-03-12 – 5 Missing spf flags for hackerone.com #57736 Valid Cryptography – 2015-04-23 – 5 Homograph attack #58612 Valid Misconfiguration and Insecure Design – 2015-05-02 – 5 Homograph Attack #59372 Valid Open Redirect – 2015-05-09 – 5 Content Spoofing - External Link Warning Page #60402 Valid Misconfiguration and Insecure Design – 2015-05-11 – 5 Email Notification should be get while changing Paypal Email #62827 Valid Authentication – 2015-06-19 – 5 Potential denial of service in hackerone.com/<program>/reward_settings #63865 Valid Denial of Service – 2015-06-10 – 5 mailto: link injection on https://hackerone.com/directory #66262 Valid Misconfiguration and Insecure Design – 2015-06-10 – 5 Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc. #90367 Valid Information Disclosure – 2015-09-25 – 5 Minimum bounty of a private program is visible for users that were removed from the program #94336 Valid Information Disclosure – 2015-10-21 – 5 Enumeration/Guess of Private (Invited) Programs #32990 Valid Misconfiguration and Insecure Design – 2015-05-09 – 6 Markdown code block sequence makes report unreadable #46952 Valid No weakness recorded – 2015-06-29 – 6 Team member invitations to sandboxed teams are not invalidated consistently (v2) #48422 Valid Access Control – 2015-02-27 – 6 Auto Approval of Invitation to join Team as a Team member #49566 Valid Misconfiguration and Insecure Design – 2015-03-11 – 6 SPF whitelist of mandrill leads to email forgery #56742 Valid Authentication – 2015-06-08 – 6 Open-redirect on hackerone.com #57163 Valid Open Redirect – 2015-04-23 – 6 Making any Report Failed to load #59369 Valid Denial of Service – 2015-05-09 – 6 Reopen Disable Accounts/ Hidden Access After Disable #59659 Valid Authentication – 2015-06-08 – 6 Logical Issue (Boosting Reputation points) #60429 Informative No weakness recorded – 2015-07-21 – 6 Invitation is not properly cancelled while inviting to bug reports. #66151 Valid Authentication – 2015-07-10 – 6 Cross-domain AJAX request #97948 Valid Open Redirect – 2015-11-14 – 6 profile cover can also load external URL's #99687 Valid Misconfiguration and Insecure Design – 2015-12-02 – 6 In markdown, parsing things like @danlec and #46072 after links is unsafe #46312 Valid No weakness recorded – 2015-07-04 – 7 "learn more here", reward email - domain expired. #52532 Valid Open Redirect – 2015-03-23 – 7 Accessing title of the report of which you are marked as duplicate #75556 Valid Authentication – 2015-07-17 $500 7 Send AJAX request to external domain #97191 Valid Cross-site Scripting – 2015-11-14 – 7 Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports #106084 Valid Authentication – 2015-12-29 $500 7 Report title autocompletion #263 Valid Information Disclosure – 2015-06-08 – 8 Autocomplete enabled in Paypal preferences #842 Valid Misconfiguration and Insecure Design – 2015-05-28 – 8 javascript: and mailto: links are allowed on users' profiles #4184 Valid Cross-site Scripting – 2015-05-13 – 8 Logic Issue with Reputation: Boost Reputation Points #36211 Valid Misconfiguration and Insecure Design – 2015-04-28 – 8 Insecure Direct Object Reference vulnerability #46397 Valid Misconfiguration and Insecure Design – 2015-02-20 $500 8