Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Catch mails sent to an SMTP Server over SSL using an Evil SMTP Server#519582 | Valid | Cryptography | High | 2019-08-22 | – | 13 |
| UBNT Amplification DDOS Attack#221625 | Valid | No weakness recorded | Critical | 2019-02-06 | – | 14 |
| Resource Consumption DOS on Edgemax v1.10.6#406614 | Valid | Denial of Service | High | 2019-08-04 | – | 15 |
| EdgeSwitch Command Injection#508256 | Valid | Command and Code Injection | Medium | 2019-03-31 | – | 15 |
| JetBrains .idea project directoryAnalysed#80990 | Valid | Misconfiguration and Insecure Design | – | 2019-09-19 | – | 20 |
| UniFi Video Server web interface Configuration Restore CSRF leading to full application compromiseAnalysed#329749 | Valid | Cross-Site Request Forgery | High | 2019-04-28 | – | 22 |
| Login as root without password on EdgeSwitchXAnalysed#512958 | Valid | Authentication | Medium | 2019-03-31 | – | 56 |
| CORS Misconfiguration leading to Private Information DisclosureAnalysed#430249 | Valid | Access Control | High | 2019-06-07 | – | 57 |
| Privilege-0 to Root Privilege Escalation on EdgeSwitchAnalysed#511025 | Valid | Access Control | High | 2019-03-31 | – | 82 |
| Privilege Escalation From user to SYSTEM via unauthenticated command executionAnalysed#544928 | Valid | Command and Code Injection | Critical | 2019-11-08 | – | 553 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.