Reputation gain split by company can be used to track the existence of otherwise undisclosed reports #311449 N/A Information Disclosure Low 2018-02-02 – 4 Information Disclosure which violate program privacy #313075 Informative Information Disclosure Low 2018-02-20 – 5 Partial disclosure of undisclosed programs through <meta> tags #302620 Informative Information Disclosure – 2018-01-11 – 6 Ajouter le même utilisateur que celui déjà inscrit dans les équipes #378209 Informative No weakness recorded – 2018-07-17 – 7 Information leakage - Private reports cached by Google #80118 Informative Information Disclosure – 2018-07-23 – 8 Leakage badges on disabled user #325594 Informative Information Disclosure Low 2018-03-15 – 8 Information disclosure #350432 Duplicate Information Disclosure Low 2018-12-27 – 8 Missing Password Confirmation at a Critical Function (Payout Method) #303299 Informative Misconfiguration and Insecure Design Medium 2018-01-10 – 10 While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal) #307424 Informative Misconfiguration and Insecure Design Low 2018-01-23 – 10 GitHub users outside of HackerOne organization can create and update Wiki pages of certain public HackerOne repositories #459634 Valid Input Validation and Logic None 2018-12-12 – 12 Lack of cross-origin request blocking allows leaking of sensitive information on several endpoints #350739 Duplicate Information Disclosure – 2018-06-07 – 15 Submitted reports state logs leakage #306733 Informative Information Disclosure Medium 2018-01-19 – 16 Invalid Phabricator API token revealed through error message when escalating a report #335123 Valid Information Disclosure None 2018-06-27 $500 18 Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled #357576 Informative Information Disclosure None 2018-06-07 – 18 Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report #442843 Valid Access Control Low 2018-12-04 $500 21 People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed #353310 Valid Information Disclosure Low 2018-06-25 $500 23 Self DOM-Based XSS in www.hackerone.com #406587 Valid Cross-site Scripting Low 2018-11-08 – 23 Hacker can request mediation for published reports #412988 Valid Access Control Low 2018-11-27 $500 23 User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program #350964 Valid Information Disclosure None 2018-06-27 – 24 Unicorn worker pool exhaustion by continuously updating payout preferences #317543 Valid Denial of Service Medium 2018-03-30 – 25 Program profile_metrics.json contains time to triage for deptofdefense even it's turned off #318399 Valid Information Disclosure None 2018-03-09 $250 27 A user can request a report to be retested even though the program has not been verified by HackerOne #448078 Valid Access Control Low 2018-12-27 – 27 Can read features from any user #316810 Valid Information Disclosure Medium 2018-03-12 $250 28 CSRF at [Apply to this program] that lead to submit your request automatic with out any validations #334253 Valid Misconfiguration and Insecure Design Low 2018-07-05 – 30 Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties #395518 Valid Information Disclosure Low 2018-08-17 – 32 Attacker can claim credentials for private program that has a published external program #449680 Valid Information Disclosure Medium 2018-11-29 – 32 Timing attack towards endpoints on the web without CSRF #348168 Duplicate Information Disclosure Low 2018-12-27 – 34 Accidental Access to Programs Information via SAML Login #438306 Valid No weakness recorded Critical 2018-11-14 – 34 Updating payout preference to CurrencyCloud doesn't notify user via email #240083 Valid Misconfiguration and Insecure Design None 2018-01-31 $500 35 Invitation token leaks to https://bat.bing.com #301526 Valid Information Disclosure Low 2018-01-11 – 36 Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion #297181 Valid Misconfiguration and Insecure Design Low 2018-01-22 $500 37 Private program email forwarding response invitation not expire after first use. #209140 Valid Misconfiguration and Insecure Design High 2018-05-30 – 38 Team object in GraphQL that have a published external program may expose existence of a private program #347937 Valid Information Disclosure None 2018-07-04 – 39 User with privilege to maintain External Programs can update certain churned HackerOne programs #411930 Valid Access Control Low 2018-10-25 $500 41 Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature #397031 Valid Information Disclosure Low 2018-11-07 – 42 HackerOne support disclosing report state without checking user identity #356566 Valid No weakness recorded Low 2018-06-02 $500 43 Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based" #427502 Valid Access Control Medium 2018-11-07 $2,500 43 ImageMagick GIF coder vulnerability leading to memory disclosure #302885 Valid Information Disclosure Low 2018-02-07 $500 44 Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot #357485 Valid Access Control Low 2018-06-27 $500 45 Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session Analysed #417382 Valid Authentication Low 2018-11-30 $500 47 Domain spoofing in redirect page using RTLO Analysed #299403 Valid Open Redirect Low 2018-01-30 – 48 Extra program metrics disclosed via /PROGRAM_NAME json response Analysed #327088 Valid Information Disclosure Medium 2018-03-28 – 51 Open Redirection in index.php page Analysed #320376 Valid Open Redirect None 2018-03-07 – 53 Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding Analysed #331691 Valid Input Validation and Logic Low 2018-04-18 $500 54 Private program policy page still accessible after user left the program Analysed #386997 Valid Information Disclosure Medium 2018-08-12 $2,500 57 Team object exposes amount of participants in a private program to non-invited users Analysed #380317 Valid Information Disclosure Medium 2018-07-20 – 59 HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information Analysed #378122 Valid Information Disclosure None 2018-07-26 – 60 TeamProfile exposes partially sensitive information through GraphQL Analysed #389600 Valid Information Disclosure Low 2018-08-08 – 60 Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile Analysed #347693 Valid Information Disclosure Medium 2018-05-08 $2,500 64 HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms Analysed #298265 Valid No weakness recorded None 2018-03-13 – 65