Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| HTML form without CSRF protection at http://try.crashlytics.com/enterprise/#25128 | Valid | Cross-Site Request Forgery | – | 2014-10-02 | – | – |
| CSRF in crashlytics.com#13856 | Valid | Cross-Site Request Forgery | – | 2014-09-08 | – | 1 |
| Captcha bypass with extension at http://www.mopub.com/about/contact/#15047 | Informative | Cryptography | – | 2014-09-22 | – | 1 |
| password sent over HTTP#20081 | Valid | Cryptography | – | 2014-08-05 | – | 1 |
| Missing Rate Limiting on https://twitter.com/account/complete#27166 | Valid | Information Disclosure | – | 2014-11-10 | – | 1 |
| Twitter Flight SSL 2.0 deprecated protocol vulnerability.#29206 | Valid | Cryptography | – | 2014-10-07 | – | 1 |
| XSS platform.twitter.com | video-js metadata#29360 | Valid | Cross-site Scripting | – | 2014-11-17 | – | 1 |
| Options Method Enabled#33987 | Informative | No weakness recorded | – | 2014-12-26 | – | 1 |
| XSS vulnerability in video player page#15125 | Valid | Cross-site Scripting | – | 2014-08-02 | – | 2 |
| Cookie not marked as secure.#15232 | Valid | No weakness recorded | – | 2014-08-04 | – | 2 |
| Full path disclosure at ads.twitter.com#26825 | Valid | Information Disclosure | – | 2014-11-17 | $140 | 2 |
| Creating Unauthorized Audience Lists#31188 | Informative | Misconfiguration and Insecure Design | – | 2014-11-28 | – | 2 |
| BROKEN AUTHENTICATION IN MOBILE VERIFICATION#33432 | Informative | Misconfiguration and Insecure Design | – | 2014-12-14 | – | 2 |
| Option Method Enabled on web server#33986 | Informative | No weakness recorded | – | 2014-12-25 | – | 2 |
| Token remains alive ever after logging out!#14177 | Informative | Authentication | – | 2014-11-17 | – | 3 |
| uclfinal.twitter.com and euro2012.twitter.com are vulnerable to CRIME attack#14199 | Informative | Cryptography | – | 2014-08-16 | – | 3 |
| XSS platform.twitter.com#29328 | Valid | Cross-site Scripting | – | 2014-11-17 | – | 3 |
| XSS in fabric.io#32519 | Valid | Cross-site Scripting | – | 2014-12-23 | – | 3 |
| DOM Cross-Site Scripting ( XSS )#33091 | Valid | Cross-site Scripting | – | 2014-12-03 | $1,400 | 3 |
| Flaw in valid password policy.#33331 | Informative | Authentication | – | 2014-11-30 | – | 3 |
| Headers Missing#36053 | Informative | Misconfiguration and Insecure Design | – | 2014-11-15 | – | 3 |
| Abuse of "Remember Me" functionality.#37822 | Informative | Authentication | – | 2014-12-29 | – | 3 |
| Open redirection in fabric.io#39631 | Valid | Open Redirect | – | 2014-12-18 | $280 | 3 |
| XSS ON MOPUB.COM#15356 | Valid | Cross-site Scripting | – | 2014-08-15 | – | 4 |
| Password reset link not validated.#22012 | Informative | Denial of Service | – | 2014-08-31 | – | 4 |
| ads.twitter.com xss#27511 | Valid | Cross-site Scripting | – | 2014-11-17 | – | 4 |
| Stored xss#27846 | Valid | Cross-site Scripting | – | 2014-09-27 | – | 4 |
| Delete Credit Cards from any Twitter Account in ads.twitter.com [New Vulnerability]#27404 | Valid | Authentication | – | 2014-09-30 | – | 6 |
| Cross site scripting on ads.twitter.com#28150 | Valid | Cross-site Scripting | – | 2014-10-16 | – | 7 |
| Broken authentication and invalidated email address leads to account takeover#22203 | Informative | Cryptography | – | 2014-11-28 | – | 9 |
| URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWSAnalysed#32825 | Valid | Cross-site Scripting | – | 2014-11-03 | – | 50 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.