Requesting unknown file type returns Ruby object w/ address #109420 Valid Information Disclosure – 2016-02-19 – 2 User with Read-Only permissions can manually public disclosure the report #118718 Valid Misconfiguration and Insecure Design – 2016-04-21 $500 2 User with Read-Only permissions can edit the SwagAwarded Activities on Bug Reports #118731 Valid Access Control – 2016-04-01 – 2 Denial of service in report view. #140720 Informative Denial of Service – 2016-05-27 – 2 Redirection Page throwing error instead of redirecting to site #67929 Valid Misconfiguration and Insecure Design – 2016-05-25 – 3 Internal bounty and swag details disclosed as part of JSON response #81083 Valid Information Disclosure – 2016-04-25 $500 3 User with Read-Only permissions can request/approve public disclosure #109483 Valid Misconfiguration and Insecure Design – 2016-02-19 $500 3 Abusing HOF rankings in limited circumstances #118684 Informative Misconfiguration and Insecure Design – 2016-04-21 – 3 User with Read-Only permissions can edit the Internal comment Activities on Bug Reports After Revoke the team access permissions #119221 Valid Access Control – 2016-04-01 $500 3 SECURITY: Referencing previous Reports attachment_IDs on new Reports via Draft_Sync DELETES Attachments #123615 Valid Misconfiguration and Insecure Design – 2016-04-30 – 3 CSV Injection via the CSV export feature #124223 Valid Command and Code Injection – 2016-04-25 – 3 Content Spoofing via reports #32137 Valid Misconfiguration and Insecure Design – 2016-05-25 – 4 Putting link inside link in markdown #115205 Valid Denial of Service – 2016-04-02 – 4 Distinguish EP+Private vs Private programs in HackerOne #118965 Valid Information Disclosure – 2016-04-25 – 4 Edit Auto Response Messages #123027 Valid Misconfiguration and Insecure Design – 2016-03-15 $1,000 4 Email Address Leak #123170 Duplicate Information Disclosure – 2016-03-31 – 4 Mediation link can be accepted by other users #123420 Valid Authentication – 2016-04-25 $500 4 Sending emails (via HackerOne) impersonating other users #123743 Valid Misconfiguration and Insecure Design – 2016-03-18 – 4 Disclosure of private programs that have an "external" page on HackerOne #124611 Valid Information Disclosure – 2016-04-01 – 4 Spamming any user from Reset Password Function #12782 N/A Misconfiguration and Insecure Design – 2016-05-03 – 5 URL Crashing browser. {Tested on firefox, Chrome and Safari} #39139 Valid Denial of Service – 2016-05-25 – 5 Add text to the title of the page "Thanks" #44359 Valid Misconfiguration and Insecure Design – 2016-04-25 – 5 attack in not an authorized user #111676 Valid Denial of Service – 2016-02-16 – 5 Private Program Disclosure in /:handle/settings/allow_report_submission.json endpoint #116798 Valid Information Disclosure – 2016-02-24 – 5 Possible XSS #123278 Informative Cross-site Scripting – 2016-04-21 – 5 HackerOne Important Emails Notification are sent in clear-text #127175 Valid Authentication – 2016-05-19 – 5 Signals get affected once reports closed as self #108928 Valid Misconfiguration and Insecure Design – 2016-04-25 – 6 Multiple issues with Markdown and URL parsing #113070 Valid Misconfiguration and Insecure Design – 2016-04-21 $500 6 Private Program Disclosure in /:handle/reports/draft.json endpoint #116032 Valid Authentication – 2016-02-16 – 6 Denial of Service any Report #118663 Valid Denial of Service – 2016-03-09 – 6 Websites opened from reports can change url of report page #124889 Valid Cross-Site Request Forgery – 2016-04-21 – 6 New hacktivity view discloses report IDs of non-public reports #127235 Valid No weakness recorded – 2016-04-26 – 6 DOS Report FILE html inside <code> in markdown #127827 Valid Denial of Service – 2016-05-21 – 6 Accepting Invalid characters on email address #3991 Valid Misconfiguration and Insecure Design – 2016-04-25 – 7 Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants #107336 Valid Access Control – 2016-01-27 – 7 Null byte injection #116189 Valid No weakness recorded – 2016-02-23 – 7 Deleted name still present via mouseover functionality for user accounts #127914 Valid Information Disclosure – 2016-04-21 – 7 Increase number of bugs by sending duplicate of your own valid report #116951 Valid Misconfiguration and Insecure Design – 2016-04-25 – 8 External links should use rel="noopener" or use the redirect service #124620 Valid Open Redirect – 2016-04-05 – 8 External programs revealing info #124929 Valid Authentication – 2016-04-01 $1,500 8 Reflected Filename Download #54034 Valid Command and Code Injection – 2016-04-25 – 9 Private program activity timeline information disclosure #116029 Valid Authentication – 2016-03-16 – 9 Reputation Manipulation (Theoretical) #132057 N/A Misconfiguration and Insecure Design – 2016-04-19 – 9 Disclosure of external users invited to a specific report #157699 Valid Information Disclosure – 2016-09-01 – 9 Information disclosure via policy update notifications after removal from program #177484 Valid Information Disclosure – 2016-10-29 – 9 LinkedIN URL should be HTTPS #1093 Valid No weakness recorded – 2016-05-18 – 10 Reflected File Download #39658 Valid Misconfiguration and Insecure Design – 2016-04-25 – 10 CSV Injection via the CSV export feature #111192 Valid Command and Code Injection – 2016-02-16 – 10 New hacktivity view discloses report IDs of non-public reports #127620 Valid Misconfiguration and Insecure Design – 2016-04-05 $500 10 Reward Money Leakage #149435 Informative Information Disclosure – 2016-08-09 – 10