Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Flash-based XSS in cdnjs.cloudflare.com subdomain#9017 | No longer public | Cloudflare Vulnerability Disclosure | Cross-site Scripting | – | – | – | – |
| Cookie missing the Secure flag#9031 | No longer public | Cloudflare Vulnerability Disclosure | No weakness recorded | – | – | – | – |
| Sensitive settings need Re authentication#14698 | No longer public | WePay | Authentication | – | – | – | – |
| Open Redirect#14699 | No longer public | WePay | Open Redirect | – | – | $300 | – |
| Typical form vulnerable to csrf attack#14751 | No longer public | WePay | Cross-Site Request Forgery | – | – | – | – |
| oauth redirect uri validation bug leads to open redirect and account compromise#20661 | No longer public | WePay | Open Redirect | – | – | – | – |
| CSRF (Make email primary) may lead to account compromise#25405 | No longer public | WePay | Cross-Site Request Forgery | – | – | – | – |
| Horizontal Privilege Escalation#29420 | No longer public | WePay | Access Control | – | – | $350 | – |
| OPTIONS METHOD ENABLED#37102 | No longer public | Eobot | Misconfiguration and Insecure Design | – | – | – | – |
| Multiple information disclosure#37862 | No longer public | Eobot | Information Disclosure | – | – | – | – |
| Broken Authentication – Session Token bug#39203 | No longer public | WePay | Misconfiguration and Insecure Design | – | – | – | – |
| Unvalidated Redirects and Stored XSS#44739 | No longer public | Dropbox | Cross-site Scripting | – | – | – | – |
| Create N Accounts In Dropbox Irrespective Of Domain#49378 | No longer public | Dropbox | Memory Corruption | – | – | – | – |
| unknow files Upload in profile photo#52383 | No longer public | Dropbox Acquisitions | Misconfiguration and Insecure Design | – | – | – | – |
| XSS in https://hackpad.com/#53628 | No longer public | Dropbox Acquisitions | Cross-site Scripting | – | – | $216 | – |
| XSS in version history of an HTML file in a shared folder#56803 | No longer public | Dropbox | Cross-site Scripting | – | – | – | – |
| Clickjacking : https://partners.cloudflare.com/#106362 | No longer public | Cloudflare Vulnerability Disclosure | Misconfiguration and Insecure Design | – | – | – | – |
| Insecure transition from HTTP to HTTPS in form post#123915 | No longer public | New Relic | Information Disclosure | – | – | – | – |
| XSS (Reflected)#176477 | No longer public | New Relic | Cross-site Scripting | – | – | – | – |
| Cookie Misconfiguration#180397 | No longer public | Boozt Fashion AB | Authentication | – | – | – | – |
| Moniter Failed Sends too many emails#194952 | No longer public | New Relic | No weakness recorded | – | – | – | – |
| Broken Authentication and session management OWASP A2#205309 | No longer public | New Relic | Authentication | – | – | – | – |
| Sensitive information disclosure#207388 | No longer public | New Relic | Information Disclosure | – | – | – | – |
| Missing URL sanitization in comments can be leveraged for phishing#252894 | No longer public | Dropbox | Input Validation and Logic | – | – | – | – |
| Newrelic s3 bucket is writeable and deleteable by authorized AWS users#277262 | No longer public | New Relic | Authentication | – | – | – | – |
| No Confirmation During Email Change#280304 | No longer public | Boozt Fashion AB | No weakness recorded | – | – | – | – |
| Server Name disclosure#825815 | No longer public | Qulture.Rocks | Information Disclosure | – | – | – | – |
| Missing (or redundant) null check in `dcrypt_openssl_sign`#883606 | No longer public | Open-Xchange | Memory Corruption | – | – | – | – |
| Null dereference in mcht_relational_validate ext-relational-common.c:136#894446 | No longer public | Open-Xchange | Memory Corruption | – | – | $50 | – |
| A specifically designed sieve script can cause a DoS in lib-sieve during sieve script compilation via NULL pointer dereference#965774 | No longer public | Open-Xchange | Memory Corruption | – | – | – | – |
| Assert failed in `edit_mail_istream_read`#965790 | No longer public | Open-Xchange | Input Validation and Logic | – | – | $50 | – |
| Null dereference in `cmd_denotify_operation_execute`#965881 | No longer public | Open-Xchange | Memory Corruption | – | – | $50 | – |
| Limited access to billing dashboard by Admin and Collaborator in conflict with user role permissions.#1075540 | No longer public | Doppler | Information Disclosure | – | – | – | – |
| jplayer.swf Cross-site scripting#8786 | No longer public | Cloudflare Vulnerability Disclosure | Cross-site Scripting | – | – | – | 1 |
| XSS - http://js.cloudflare.com#8920 | No longer public | Cloudflare Vulnerability Disclosure | Cross-site Scripting | – | – | – | 1 |
| System Status Update CSRF#8943 | No longer public | Cloudflare Vulnerability Disclosure | Cross-Site Request Forgery | – | – | – | 1 |
| Security issue with your "bag" script#9560 | No longer public | Cloudflare Vulnerability Disclosure | No weakness recorded | – | – | – | 1 |
| Threat control information leak#9775 | No longer public | Cloudflare Vulnerability Disclosure | Cross-Site Request Forgery | – | – | – | 1 |
| User's data leak#10841 | No longer public | Cloudflare Vulnerability Disclosure | No weakness recorded | – | – | – | 1 |
| Bug Report#10975 | No longer public | Cloudflare Vulnerability Disclosure | No weakness recorded | – | – | – | 1 |
| CSRF and No password requirement in this URL Billing Info#12034 | No longer public | Cloudflare Vulnerability Disclosure | Cross-site Scripting | – | – | – | 1 |
| CSRF & Nonce Token Weak Implementation#14702 | No longer public | WePay | Cross-Site Request Forgery | – | – | – | 1 |
| CSRF on email address operations. Also performing unintended operations.#18507 | No longer public | WePay | Cross-Site Request Forgery | – | – | $150 | 1 |
| Unauthorized Access via Join Email Link#18845 | No longer public | WePay | Misconfiguration and Insecure Design | – | – | $100 | 1 |
| Apache mod_negotiation filename bruteforcing#25382 | No longer public | Cloudflare Vulnerability Disclosure | Cryptography | – | – | – | 1 |
| Suck My Motherfucking Dick#33587 | No longer public | Uzbey | Denial of Service | – | – | – | 1 |
| Privilege Escalation at invite feature @hackpad.com#47932 | No longer public | Dropbox Acquisitions | Access Control | – | – | $729 | 1 |
| Get email ID of any user on hackpad.com#56494 | No longer public | Dropbox Acquisitions | Information Disclosure | – | – | $216 | 1 |
| XSS in dropbox main domain#59356 | No longer public | Dropbox | Cross-site Scripting | – | – | $512 | 1 |
| Html injection in monitor name textbox#114852 | No longer public | New Relic | Open Redirect | – | – | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.