Verbose PHP error messages exposed on a blog article #439174 Valid Information Disclosure None 2019-04-10 – 11 Missing rate limit on critical user actions e.g. reset password, change email, disable account. #157750 Valid Access Control – 2019-04-11 – 14 CSV Injection at the CSV export feature #118582 Valid Command and Code Injection Low 2019-04-08 – 15 Moving a report to a different program doesn't reassign the Custom Field Values #511779 Valid Insecure Direct Object Reference Low 2019-04-25 – 15 Invited team member can disclosure slack channels #509574 Valid Information Disclosure Low 2019-04-05 $500 16 Previous attachments can be referenced when creating a new report #129773 Valid Misconfiguration and Insecure Design Low 2019-04-12 – 17 Missing Certificate Authority Authorization rule #410245 Valid Cryptography None 2019-04-11 – 17 Lack of length validation on user address attribute #161947 Valid Denial of Service None 2019-04-11 – 18 Corrupted Authorization header can cause logs not to be ingested properly in ████████ #447488 Valid No weakness recorded Medium 2019-04-04 – 19 Homograph attack in escalate report #143975 Valid Misconfiguration and Insecure Design Low 2019-04-19 – 20 Session hijacking attack #163381 N/A No weakness recorded – 2019-12-06 – 21 report id is exposed for undisclosed reports in Hacktivity #493484 Informative Information Disclosure Low 2019-02-16 – 24 Information Disclosure when /invitations/<token>.json is not yet accepted #290930 Valid Information Disclosure Medium 2019-12-06 – 25 Submitting report through Embedded Submission form gives user indefinite access to a profile #463828 Valid Input Validation and Logic Low 2019-01-03 $500 29 Disclosure of h1 challenges name through the calendar #488643 Valid Information Disclosure Low 2019-01-30 – 29 A small set of users were assigned someone else's payout preference #498845 Valid Information Disclosure Low 2019-02-20 – 30 Open Redirection in [https://www.hackerone.com/index.php] #562417 Valid Open Redirect None 2019-05-08 – 33 IDOR in Bugs overview enables attacker to determine the date range a hackathon was active #663431 Valid Insecure Direct Object Reference Low 2019-12-13 – 33 Program Email Nofication settings ignored when being added as an external contributor Analysed #645264 Valid Information Disclosure Low 2019-08-07 – 34 HackerOne Integrations Design Issue Analysed #172289 Valid Misconfiguration and Insecure Design Medium 2019-04-11 $500 36 Open redirect vulnerability in index.php Analysed #439075 Valid Open Redirect None 2019-02-03 – 39 Disclosure of Program email Title Report when being removed as contributor. Bypass for Report #645264 Analysed #669776 Valid Information Disclosure Low 2019-09-06 – 39 Path traversal leading to limited CSRF on GET requests on two endpoints Analysed #301862 Valid No weakness recorded – 2019-04-05 – 41 User login page doesn't implement any form of rate limiting Analysed #410451 Valid Authentication Low 2019-01-04 – 42 Hogging up all the resources on hackerone.com Analysed #125587 Valid Denial of Service Medium 2019-04-10 – 44 Repeated mediation requests and multiple emails possible on a report. Analysed #156948 Valid No weakness recorded – 2019-04-11 $500 44 Disclosing a private program in an external link if program is paused Analysed #418474 Valid No weakness recorded Low 2019-06-28 $500 44 API Last Request Date/Time Not Updating Analysed #220774 Valid Input Validation and Logic Low 2019-05-19 – 45 Response program can create bounty table Analysed #460920 Valid Input Validation and Logic Low 2019-01-07 $500 46 Response program can display "eligible for bounty" in scope area in program policy Analysed #475660 Valid Input Validation and Logic Low 2019-01-30 $500 47 Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled Analysed #634679 Valid Access Control Medium 2019-07-05 – 47 View HackerOne challenge scope before challenge begins Analysed #565736 Valid Access Control Low 2019-07-11 – 48 Total bounties paid amount is disclosed because of redesign of the Program Profiles Analysed #640488 Valid Information Disclosure Low 2019-08-02 – 50 Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details Analysed #447930 Valid Insecure Direct Object Reference High 2019-01-11 – 54 Race condition in claiming program credentials Analysed #488985 Valid Race Conditions Low 2019-05-19 – 54 Disclosure of Email title report in quick award paypout email (no content mode) Analysed #689997 Valid Information Disclosure Low 2019-10-11 $500 62 Any user with access to program can resume and suspend HackerOne Gateway Analysed #717716 Valid Insecure Direct Object Reference Medium 2019-10-21 – 65 IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs Analysed #510759 Valid Insecure Direct Object Reference Low 2019-09-06 – 67 Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeover Analysed #514451 Valid Server-Side Request Forgery None 2019-04-04 $500 68 Team object in GraphQL disclosed of private programs via the industry Analysed #707406 Valid No weakness recorded Low 2019-11-23 $500 72 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid Insecure Direct Object Reference Medium 2019-10-25 – 76 latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users Analysed #724944 Valid Information Disclosure Low 2019-11-10 – 79 Private information exposed through GraphQL filters Analysed #645299 Valid Information Disclosure Medium 2019-07-23 – 81 Race Condition in Flag Submission Analysed #454949 Valid Race Conditions Low 2019-07-22 – 94 Password not checked when disabling 2FA on HackerOne Analysed #587910 Valid Misconfiguration and Insecure Design Low 2019-06-07 – 95 [Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content" Analysed #669438 Valid No weakness recorded Low 2019-09-09 $500 104 DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054) Analysed #499030 Valid Cross-site Scripting Low 2019-05-04 – 106 ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages Analysed #713407 Valid Denial of Service Medium 2019-12-13 – 111 Emails of invited collaborators are disclosed in full in payload for report participants Analysed #269230 Valid Information Disclosure Low 2019-04-09 – 112 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. Analysed #397792 Valid Input Validation and Logic Medium 2019-01-02 – 117