Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Two Error-Based SQLi in courses.aspx on ██████████#227102 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | – |
| Improper error message#263681 | Informative | Legal Robot | No weakness recorded | Medium | 2017-09-01 | – | – |
| Crashes/Buffer at 0x2C0086,name=PBrowser::Msg_Destroy#281682 | Informative | Tor | Memory Corruption | Medium | 2017-10-24 | – | – |
| Media parsing in canvas is at least vulnerable to Denial of Service through multiple vulnerabilities#315037 | Valid | Node.js third-party modules | Memory Corruption | Medium | 2019-04-03 | – | – |
| Use After Free in GC with Certain Destructors#672245 | Valid | Internet Bug Bounty | Memory Corruption | Medium | 2020-11-09 | – | – |
| Double-free of `trailers_buf' on `Curl_http_compile_trailers()` failure#687734 | Informative | curl | Memory Corruption | Medium | 2021-01-12 | – | – |
| Incorrect IPv6 literal parsing leads to validated connection to unexpected https server.#688048 | Informative | curl | Injection and Smuggling | Medium | 2021-01-12 | – | – |
| Crash Node.js process from handlebars using a small and simple source#726364 | Valid | Node.js third-party modules | Denial of Service | Medium | 2020-04-27 | – | – |
| Port and service scanning on localhost due to improper URL validation.#773313 | N/A | curl | Information Disclosure | Medium | 2020-01-15 | – | – |
| PHP builded for Windows with TS support does not resolve relalative paths with drive letter correctly#797159 | Valid | Internet Bug Bounty | File and Path Handling | Medium | 2020-11-09 | – | – |
| [commit-msg] RCE via insecure command formatting#885031 | Valid | Node.js third-party modules | Command and Code Injection | Medium | 2020-09-24 | – | – |
| XSS DI BIODATA#949823 | Valid | Bumble | Cross-site Scripting | Medium | 2020-11-09 | – | – |
| Use after free vulnerability in phar_parse_zipfile#950299 | Valid | Internet Bug Bounty | Memory Corruption | Medium | 2020-11-09 | – | – |
| Data race conditions reported by helgrind when performing parallel DNS queries in libcurl#1019457 | Informative | curl | Information Disclosure | Medium | 2020-11-04 | – | – |
| CUI labled and ████ Restricted pdf on █████#1243782 | Valid | U.S. Dept Of Defense | Information Disclosure | Medium | 2021-08-26 | – | – |
| Sensitive information on '████████'#1300591 | Valid | U.S. Dept Of Defense | Cryptography | Medium | 2021-08-26 | – | – |
| DLL hijacking in Monero GUI for Windows 0.17.3.0 would allow an attacker to perform remote command execution#1437942 | Informative | Monero | Command and Code Injection | Medium | 2021-12-30 | – | – |
| XSS in Search Communities Function#47235 | Valid | Informatica | Cross-site Scripting | Medium | 2015-07-31 | – | 1 |
| SPF DNS Record#115275 | Valid | Gratipay | Misconfiguration and Insecure Design | Medium | 2016-03-15 | – | 1 |
| prevent content spoofing on /search#115284 | Valid | Gratipay | Misconfiguration and Insecure Design | Medium | 2016-04-06 | – | 1 |
| DMARC is misconfigured for grtp.co#117325 | Valid | Gratipay | Misconfiguration and Insecure Design | Medium | 2016-04-02 | $10 | 1 |
| The websocket traffic is not secure enough#178990 | Informative | Legal Robot | Cross-Site Request Forgery | Medium | 2017-08-27 | – | 1 |
| Denial of service(POP UP Recursion) on Brave browser#179248 | Duplicate | Brave Software | Denial of Service | Medium | 2016-11-07 | – | 1 |
| Invalid read when wddx decodes empty boolean element#188661 | Valid | Internet Bug Bounty | Memory Corruption | Medium | 2019-11-12 | – | 1 |
| SQL injection found in US Navy Website (http://███/)#197755 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2019-12-02 | – | 1 |
| Access to job creation web page on http://████████#204996 | Valid | U.S. Dept Of Defense | Misconfiguration and Insecure Design | Medium | 2019-12-02 | – | 1 |
| Content-Injection/XSS ████#205360 | Valid | U.S. Dept Of Defense | Information Disclosure | Medium | 2019-12-02 | – | 1 |
| There is an vulnerability in https://bridge.cspr.ng where an attacker can users directory#226505 | Informative | Paragon Initiative Enterprises | No weakness recorded | Medium | 2017-05-07 | – | 1 |
| Possible User Session Hijack using Invalid HTTPS certificate on inside.gratipay.com domain#242622 | N/A | Gratipay | Misconfiguration and Insecure Design | Medium | 2017-06-24 | – | 1 |
| Hyper Link Injection In email and Space Characters Allowed at Password Field.#252699 | Informative | Phabricator | No weakness recorded | Medium | 2017-07-23 | – | 1 |
| Create Api Key is not working#255025 | Informative | Legal Robot | No weakness recorded | Medium | 2017-08-26 | – | 1 |
| WebDAV Empty Property search leads to full CPU usage#255822 | Valid | Nextcloud | Denial of Service | Medium | 2020-03-01 | – | 1 |
| Arbitrary local code execution via DLL hijacking from executable installer#272221 | Duplicate | Brave Software | Misconfiguration and Insecure Design | Medium | 2018-07-09 | – | 1 |
| Email Spoofing#276614 | Duplicate | Semrush | Misconfiguration and Insecure Design | Medium | 2018-03-13 | – | 1 |
| Enforce minimum master password complexity#280282 | N/A | Tor | Authentication | Medium | 2017-10-19 | – | 1 |
| No notification on Password Change#282570 | Duplicate | Infogram | No weakness recorded | Medium | 2017-10-27 | – | 1 |
| Security misconfiguration "weak passwords".#285482 | Informative | Semrush | Misconfiguration and Insecure Design | Medium | 2018-03-13 | – | 1 |
| Prototype pollution attack (merge-objects)#310706 | Valid | Node.js third-party modules | No weakness recorded | Medium | 2018-04-15 | – | 1 |
| typeorm does not properly escape parameters when building SQL queries, resulting in potential SQLi#319458 | Valid | Node.js third-party modules | SQL Injection | Medium | 2019-04-03 | – | 1 |
| memory corruption while parsing HTTP response#320222 | Valid | Internet Bug Bounty | Memory Corruption | Medium | 2019-10-14 | $500 | 1 |
| [statics-server] Path Traversal due to lack of provided path sanitization#355456 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2019-04-03 | – | 1 |
| [servey] Path Traversal allows to retrieve content of any file with extension from remote server#355501 | Valid | Node.js third-party modules | File and Path Handling | Medium | 2019-04-03 | – | 1 |
| Brave allows flash to follow 307 redirects to other origins with arbitrary content-types#449478 | Informative | Brave Software | Misconfiguration and Insecure Design | Medium | 2018-12-12 | – | 1 |
| [https://███] Local File Inclusion via graph.php#492767 | Valid | U.S. Dept Of Defense | File and Path Handling | Medium | 2020-05-14 | – | 1 |
| Uninitialized read in gdImageCreateFromXbm#623588 | Valid | Internet Bug Bounty | Information Disclosure | Medium | 2020-10-10 | – | 1 |
| Command Injection vulnerability in kill-port-process package#661959 | Valid | Node.js third-party modules | Command and Code Injection | Medium | 2020-01-30 | – | 1 |
| SQL Injection - https://███/█████████/MSI.portal#674838 | Valid | U.S. Dept Of Defense | SQL Injection | Medium | 2020-05-14 | – | 1 |
| [██████████] — Directory traversal via `/aerosol-bin/███████/display_directory_████_t.cgi`#686343 | Valid | U.S. Dept Of Defense | File and Path Handling | Medium | 2020-05-14 | – | 1 |
| [http-live-simulator] Application-level DoS#764725 | Valid | Node.js third-party modules | Denial of Service | Medium | 2020-10-27 | – | 1 |
| Out-of-bounds Read in php_strip_tags_ex#781325 | Valid | Internet Bug Bounty | Memory Corruption | Medium | 2020-11-09 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.