Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| openssh-server Forced Command Handling Information Disclosure Vulnerability on blog.greenhouse.io#24984 | Valid | Greenhouse.io | Information Disclosure | – | 2014-10-10 | – | – |
| HTML form without CSRF protection at http://try.crashlytics.com/enterprise/#25128 | Valid | X / xAI | Cross-Site Request Forgery | – | 2014-10-02 | – | – |
| XSS via .eml file#26935 | Valid | Mail.ru | Cross-site Scripting | – | 2014-12-10 | $1,337 | – |
| Escaping the iframe via exceptions#103989 | Valid | Khan Academy | Cross-site Scripting | – | 2015-12-29 | – | – |
| Null pointer dereference in phar_get_fp_offset()#103990 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-29 | $500 | – |
| Integer overflow in _Unpickler_Read#103992 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-26 | – | – |
| Request Hijacking Vulnerability In RubyGems 2.4.6 And Earlier#103993 | Valid | RubyGems | No weakness recorded | – | 2015-05-14 | – | – |
| Python 3.3 - 3.5 product_setstate() Out-of-bounds Read#103994 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-12 | $500 | – |
| Python xmlparse_setattro() Type Confusion#104000 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-07 | $500 | – |
| time_strftime() Buffer Over-read#104001 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-07 | $500 | – |
| Python scan_eol() Buffer Over-read#104002 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-03 | $500 | – |
| Python deque.index() uninitialized memory#104003 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-03 | $1,000 | – |
| Mem out-of-bounds write (segfault) in ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER#104004 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-02 | $500 | – |
| null pointer deref (segfault) in zend_eval_const_expr#104005 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-02 | $500 | – |
| Null pointer deref (segfault) in spl_autoload via ob_start#104006 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-23 | $500 | – |
| Buffer over-read in exif_read_data with TIFF IFD tag#104007 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-01 | $1,000 | – |
| Uninitialized pointer in phar_make_dirstream#104008 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-29 | $1,000 | – |
| SOAP serialize_function_call() type confusion / RCE#104010 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-02 | – | – |
| AddressSanitizer reports a global buffer overflow in mkgmtime() function#104011 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-10-15 | $500 | – |
| Integer overflow in unserialize() (32-bits only)#104012 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-10-15 | $500 | – |
| heap buffer overflow in enchant_broker_request_dict()#104013 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-01-26 | $500 | – |
| libcurl duphandle read out of bounds#104014 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-11-05 | $1,000 | – |
| curl_setopt_array() type confusion#104015 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-04 | – | – |
| Dangling pointer in the unserialization of ArrayObject items#104016 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-05 | $1,000 | – |
| Arbitrary code execution in str_ireplace function#104017 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-04 | – | – |
| Files extracted from archive may be placed outside of destination directory#104019 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-05 | – | – |
| audioop.lin2adpcm Buffer Over-read#104020 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-26 | $500 | – |
| audioop.adpcm2lin Buffer Over-read#104021 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-28 | $500 | – |
| hotshot pack_string Heap Buffer Overflow#104022 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-27 | $500 | – |
| bytearray.find Buffer Over-read#104023 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-29 | $1,000 | – |
| array.fromstring Use After Free#104024 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-07-25 | $500 | – |
| use after free in load_newobj_ex#104025 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-07-02 | $500 | – |
| invalid pointer free() in phar_tar_process_metadata()#104026 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-05-22 | $500 | – |
| Memory Corruption in phar_parse_tarfile when entry filename starts with null#104027 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-05-12 | $500 | – |
| Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow)#104028 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-18 | – | – |
| PyFloat_FromString & PyNumber_Long Buffer Over-reads#104032 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-11-08 | $1,000 | – |
| tokenizer crash when processing undecodable source code#104033 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-11-14 | – | – |
| directory listing in https://demo.owncloud.org/doc/#105149 | Valid | ownCloud | Information Disclosure | – | 2016-01-01 | – | – |
| libphutil: removing bytes from a PhutilRope does not work as intended#105657 | Valid | Phabricator | No weakness recorded | – | 2015-12-16 | – | – |
| Format string vulnerability in zend_throw_or_error()#106548 | Valid | Internet Bug Bounty | Command and Code Injection | – | 2016-01-10 | $1,000 | – |
| [cfire.mail.ru] Time Based SQL Injection#107780 | Valid | Mail.ru | SQL Injection | – | 2016-01-15 | $150 | – |
| [https://test1.owncloud.com/owncloud6/] Guessable password used for admin user#107849 | Valid | ownCloud | No weakness recorded | – | 2016-01-02 | – | – |
| otrs.owncloud.com: Reflected Cross-Site Scripting#108288 | Valid | ownCloud | Cross-site Scripting | – | 2016-02-10 | – | – |
| Mixed Active Scripting Issue on stats.owncloud.org#108692 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-02-06 | – | – |
| Use After Free in sortWithSortKeys()#109175 | Valid | Internet Bug Bounty | Memory Corruption | – | 2016-01-20 | $1,000 | – |
| Extended policy checks are buggy#109959 | Valid | Phabricator | No weakness recorded | – | 2016-01-11 | – | – |
| The csrf token remains same after user logs in#111262 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-02-25 | – | – |
| owncloud.help: Text Injection#112304 | Valid | ownCloud | Misconfiguration and Insecure Design | – | 2016-01-23 | – | – |
| [afisha.mail.ru] SQL Injection#112555 | Valid | Mail.ru | SQL Injection | – | 2016-02-01 | $300 | – |
| Stack overflow when decompressing tar archives#114024 | Valid | Internet Bug Bounty | Memory Corruption | – | 2019-11-12 | $500 | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.