Pending member invitations are not revoked on program name change #275293 Informative Information Disclosure – 2017-11-18 – 2 Reverse Tabnabbing Vulnerability in Outgoing Links #284143 Informative No weakness recorded – 2017-11-21 – 3 Issue with password change in Disabled Account #279914 Informative Misconfiguration and Insecure Design – 2017-11-16 – 4 Open redirect deceive in hackerone.com via another open redirect link. #296706 Informative Open Redirect – 2017-12-13 – 7 Private Program all members disclosed #283309 Duplicate Information Disclosure – 2017-11-16 – 8 Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page #280770 Valid Information Disclosure – 2017-11-01 – 9 GraphQL sessions aren't immediately invalidated when user password is changed #283847 Valid Misconfiguration and Insecure Design – 2017-11-30 – 9 javascript: and mailto: links are allowed in JIRA integration settings #209917 Duplicate Misconfiguration and Insecure Design – 2017-04-10 – 12 Example HackerOne security@ forward domain is not registered #218705 Valid Misconfiguration and Insecure Design – 2017-04-10 – 17 www.hackerone.com website CSP "script-src" includes "unsafe-inline" #225833 Valid Misconfiguration and Insecure Design – 2017-05-23 – 17 Private partial disclosure of h1 infrastructure #283361 Valid Information Disclosure – 2017-11-03 – 17 Limited Open redirection using SSO-SAML #178345 Valid Open Redirect – 2017-03-26 – 19 Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com #225754 Valid Cryptography – 2017-06-21 – 19 Missing Certificate Authority Authorization rule #129992 Valid Cryptography – 2017-08-17 – 20 Able to create basic user account via Google login on HackerOne Drupal CMS #208407 Valid Authentication – 2017-04-25 – 20 Additional bypass allows SSRF for internal netblocks #288950 Valid Server-Side Request Forgery – 2017-11-16 – 20 CRLF injection in info.hacker.one #217058 Valid Injection and Smuggling – 2017-05-03 – 21 Introspection query leaks sensitive graphql system information. #291531 Duplicate Misconfiguration and Insecure Design – 2017-11-22 – 22 HackerOne is still prone to Internet Explorer UXSS #108056 Informative Cross-Site Request Forgery – 2017-04-19 – 23 Transitioning a Private Program to Public Does Not Clear Previously Private Updates to Hackers #210190 Valid Information Disclosure – 2017-04-05 $500 24 Lack of input sanitization in Marketo form leads to execution of HTML in lead emails #220009 Valid Server-Side Request Forgery – 2017-10-03 $500 25 resolved bugs in a program are public despite the program settings #270993 Valid Information Disclosure – 2017-10-13 – 25 Report redaction doesn't apply to report title update activities #196358 Valid Misconfiguration and Insecure Design – 2017-02-25 – 27 Able To Check The Exact Bounty Balance of any Bug Bounty Program #293593 Duplicate Information Disclosure – 2017-12-06 – 27 Information leakage via CSV when content is valid JavaScript #207266 Valid Cross-Site Request Forgery – 2017-05-23 – 29 Program profile metrics endpoint contains mean time to triage, even when turned off #289568 Valid Information Disclosure – 2017-11-14 – 29 Blind SSRF in "Integrations" by abusing a bug in Ruby's native resolver. #287245 Valid Server-Side Request Forgery – 2017-11-09 – 30 Invitation tokens leak to Google Analytics #237262 Valid Information Disclosure – 2017-07-16 – 32 View Any Program's Team Members through GET https://hackerone.com/invitations/ #283014 Valid Information Disclosure – 2017-11-01 $1,000 32 IDOR on Program Visibilty (Revealed / Concealed) against other team members #291721 Duplicate Insecure Direct Object Reference – 2017-11-23 – 33 Changing Victim's JIRA Integration Settings Through Multiple Bugs #226199 Valid Input Validation and Logic – 2017-05-23 $1,000 36 HackerOne reports escalation to JIRA is CSRF vulnerable #226418 Valid Cross-Site Request Forgery – 2017-08-30 $500 36 Report invitation links not restricted to any existing user #214839 Valid Information Disclosure – 2017-05-23 $500 39 IE 11 Self-XSS on Jira Integration Preview Base Link #212721 Valid Cross-site Scripting – 2017-03-29 $750 42 Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com #199779 Valid Misconfiguration and Insecure Design – 2017-03-26 – 44 Content Security Policy not applied to error pages at multiple HackerOne endpoints #250729 Valid Misconfiguration and Insecure Design – 2017-12-12 – 45 Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification #242964 Valid Input Validation and Logic – 2017-11-01 – 46 Websites opened from reports can change url of report page #189726 Valid Open Redirect – 2017-02-25 – 50 Subdomain takeover #4 at info.hacker.one #220002 Valid Access Control – 2017-06-21 – 50 Invalid Host detection at https://hackerone.com/redirect #278095 Valid Misconfiguration and Insecure Design – 2017-12-03 – 57 Subdomain takeover #3 at info.hacker.one #217358 Valid Access Control – 2017-06-21 – 58 Report Private Links Leaks to Google Analytics via Query String Param #269479 Valid Information Disclosure – 2017-10-25 – 59 Query parameter reordering causes redirect page to render unsafe URL #293689 Valid Cross-site Scripting – 2017-11-30 $1,500 61 Homograph fix Bypass #271324 Valid Misconfiguration and Insecure Design – 2017-10-16 – 71 Race condition leads to duplicate payouts #220445 Valid Access Control – 2017-05-23 – 73 Validation message in Bounty award endpoint can be used to determine program balances #293299 Valid Information Disclosure – 2017-11-29 – 73 A HackerOne employee's GitHub personal access token exposed in Travis CI build logs #215625 Valid Information Disclosure – 2017-05-23 $2,000 75 Subdomain takeover #2 at info.hacker.one #209004 Valid Access Control – 2017-04-28 – 78 IDOR on HackerOne Feedback Review #262661 Valid Insecure Direct Object Reference – 2017-09-02 – 79 Reading redacted data via hackbot's answers #247628 Valid Information Disclosure – 2017-07-27 $1,500 93