Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| openssh-server Forced Command Handling Information Disclosure Vulnerability on blog.greenhouse.io#24984 | Valid | Greenhouse.io | Information Disclosure | – | 2014-10-10 | – | – |
| HTML form without CSRF protection at http://try.crashlytics.com/enterprise/#25128 | Valid | X / xAI | Cross-Site Request Forgery | – | 2014-10-02 | – | – |
| XSS via .eml file#26935 | No longer public | Mail.ru | Cross-site Scripting | – | 2014-12-10 | $1,337 | – |
| open redirect#2414 | Informative | RelateIQ | Open Redirect | – | 2014-05-19 | – | 1 |
| XSRF token problem#2427 | Valid | RelateIQ | Misconfiguration and Insecure Design | – | 2014-04-20 | – | 1 |
| CSRF Token missing on http://baseball.fantasysports.yahoo.com/b1/127146/messages#6700 | No longer public | Yahoo! | Cross-Site Request Forgery | – | 2014-08-20 | – | 1 |
| CSRF Token is missing on DELETE message option on http://baseball.fantasysports.yahoo.com/b1/127146/messages#6702 | No longer public | Yahoo! | Cross-Site Request Forgery | – | 2014-08-20 | – | 1 |
| Open Proxy, http://www.smushit.com/ysmush.it/, 4/09/14, #SpringClean#6704 | No longer public | Yahoo! | Open Redirect | – | 2014-08-20 | – | 1 |
| Session cookie can be leaked over an unencrypted HTTP connection#6927 | Valid | IRCCloud | Misconfiguration and Insecure Design | – | 2014-05-15 | – | 1 |
| CSRF - Creating accounts#7332 | Valid | IRCCloud | Cross-Site Request Forgery | – | 2014-05-14 | – | 1 |
| Log Out Cross site Request Forgery#7516 | Valid | IRCCloud | Cross-Site Request Forgery | – | 2014-06-13 | – | 1 |
| Simplenote Silverlight cross-domain policy misconfiguration#7571 | Valid | Automattic | Cross-Site Request Forgery | – | 2014-05-17 | – | 1 |
| Session Cookie without Secure flag set#7843 | Informative | Automattic | No weakness recorded | – | 2014-05-21 | – | 1 |
| Clickjacking - changing role#7924 | Valid | Respondly | Misconfiguration and Insecure Design | – | 2014-04-21 | – | 1 |
| X-Content-Type-Options header missing#8053 | Valid | Respondly | Misconfiguration and Insecure Design | – | 2014-05-21 | – | 1 |
| Xss On http://my.mail.ru/#8448 | No longer public | Mail.ru | Cross-site Scripting | – | 2014-07-08 | – | 1 |
| Clicjacking on Login panel#8459 | No longer public | Mail.ru | Misconfiguration and Insecure Design | – | 2014-07-14 | – | 1 |
| Reflected XSS#8472 | No longer public | Mail.ru | Cross-site Scripting | – | 2014-09-10 | – | 1 |
| No CSRF token used in Phone Verification POST#9062 | No longer public | Mail.ru | Cross-Site Request Forgery | – | 2014-06-11 | – | 1 |
| SQL injection [дырка в движке форума]#9919 | No longer public | Mail.ru | SQL Injection | – | 2014-11-16 | $200 | 1 |
| Time based sql injection#9921 | No longer public | Mail.ru | SQL Injection | – | 2014-12-10 | $200 | 1 |
| All Active user sessions should be destroyed when user change his password!#10377 | Valid | C2FO | Misconfiguration and Insecure Design | – | 2014-09-23 | – | 1 |
| CSRF in function "Set as primary" on accounts page#10829 | Valid | Coinbase | Cross-Site Request Forgery | – | 2014-06-06 | – | 1 |
| Infrastructure and Application Admin Interfaces (OWASP‐CM‐007)#11414 | No longer public | Yahoo! | Access Control | – | 2014-08-20 | – | 1 |
| HTTP Strict Transport Security (HSTS) Policy Not Enabled#11945 | Informative | joola.io | Misconfiguration and Insecure Design | – | 2014-07-08 | – | 1 |
| TESTING FOR REFLECTED CROSS SITE SCRIPTING (OWASP‐DV‐001)#12011 | No longer public | Yahoo! | Cross-site Scripting | – | 2014-08-20 | – | 1 |
| Python vulnerability: reading arbitrary process memory#12297 | Valid | Internet Bug Bounty | No weakness recorded | – | 2014-06-20 | – | 1 |
| XSS in a file or folder name#12588 | No longer public | Mail.ru | Cross-site Scripting | – | 2014-07-09 | $500 | 1 |
| Authorization issue on creative.yahoo.com#12685 | No longer public | Yahoo! | Misconfiguration and Insecure Design | – | 2014-08-06 | – | 1 |
| Testing for user enumeration (OWASP‐AT‐002) - https://gh.bouncer.login.yahoo.com#12708 | No longer public | Yahoo! | Authentication | – | 2014-08-20 | – | 1 |
| Раскрытие путей сервера за счёт неопределённого индекса в сценарии /home/berserk-online.com/public_html/forum/Themes/berserker/Profile.template.php#12794 | No longer public | Mail.ru | Information Disclosure | – | 2014-09-27 | – | 1 |
| Reflected XSS in User-Agent#12804 | No longer public | Mail.ru | Cross-site Scripting | – | 2014-09-16 | – | 1 |
| (m.mail.ru) Password type input with auto-complete enabled#13200 | No longer public | Mail.ru | Information Disclosure | – | 2014-09-19 | – | 1 |
| CSRF in crashlytics.com#13856 | Valid | X / xAI | Cross-Site Request Forgery | – | 2014-09-08 | – | 1 |
| information disclosure#13939 | Valid | Automattic | Information Disclosure | – | 2014-07-16 | – | 1 |
| Multiple vulnerabilities#14248 | No longer public | Yahoo! | Command and Code Injection | – | 2014-08-20 | – | 1 |
| Captcha bypass with extension at http://www.mopub.com/about/contact/#15047 | Informative | X / xAI | Cryptography | – | 2014-09-22 | – | 1 |
| NO CSRF token found on user details update#15454 | Valid | FanFootage | Cross-Site Request Forgery | – | 2014-07-07 | – | 1 |
| Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!)#15518 | Valid | Factlink | Cryptography | – | 2014-07-13 | – | 1 |
| Same user name and uuid for multiple user names#15578 | Valid | FanFootage | Misconfiguration and Insecure Design | – | 2014-07-13 | – | 1 |
| Abusing VCS control on phabricator#16315 | Valid | Phabricator | Access Control | – | 2014-06-13 | $600 | 1 |
| Yahoo Sports Fantasy Golf (Join Public Group)#16414 | No longer public | Yahoo! | Cross-Site Request Forgery | – | 2014-08-20 | – | 1 |
| Cross-site scripting vulnerability detected#17241 | Valid | Uzbey | Denial of Service | – | 2014-07-08 | – | 1 |
| Breach Attack Vulnerability#17311 | Informative | Uzbey | Information Disclosure | – | 2014-07-23 | – | 1 |
| Clickjacking at https://staging.uzbey.com/#17315 | Informative | Uzbey | Misconfiguration and Insecure Design | – | 2014-08-07 | – | 1 |
| Flash Content-Type Sniffing Vulnerability#17390 | Valid | Uzbey | No weakness recorded | – | 2014-07-23 | – | 1 |
| LZ4 Core#17688 | Valid | Internet Bug Bounty | Memory Corruption | – | 2014-07-25 | – | 1 |
| ClientId gives away platform (iOS/Android) from which a secret was posted.#19210 | Valid | Secret | Information Disclosure | – | 2014-08-01 | – | 1 |
| Missing HSTS header in https://public-api.wordpress.com#20071 | Informative | Automattic | Cryptography | – | 2014-08-28 | – | 1 |
| password sent over HTTP#20081 | Valid | X / xAI | Cryptography | – | 2014-08-05 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.