Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Escaping the iframe via exceptions#103989 | Valid | Khan Academy | Cross-site Scripting | – | 2015-12-29 | – | – |
| Null pointer dereference in phar_get_fp_offset()#103990 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-29 | $500 | – |
| Integer overflow in _Unpickler_Read#103992 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-26 | – | – |
| Request Hijacking Vulnerability In RubyGems 2.4.6 And Earlier#103993 | Valid | RubyGems | No weakness recorded | – | 2015-05-14 | – | – |
| Python 3.3 - 3.5 product_setstate() Out-of-bounds Read#103994 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-12 | $500 | – |
| Python xmlparse_setattro() Type Confusion#104000 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-07 | $500 | – |
| time_strftime() Buffer Over-read#104001 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-07 | $500 | – |
| Python scan_eol() Buffer Over-read#104002 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-03 | $500 | – |
| Python deque.index() uninitialized memory#104003 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-03 | $1,000 | – |
| Mem out-of-bounds write (segfault) in ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER#104004 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-02 | $500 | – |
| null pointer deref (segfault) in zend_eval_const_expr#104005 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-02 | $500 | – |
| Null pointer deref (segfault) in spl_autoload via ob_start#104006 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-23 | $500 | – |
| Buffer over-read in exif_read_data with TIFF IFD tag#104007 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-01 | $1,000 | – |
| Uninitialized pointer in phar_make_dirstream#104008 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-29 | $1,000 | – |
| SOAP serialize_function_call() type confusion / RCE#104010 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-09-02 | – | – |
| AddressSanitizer reports a global buffer overflow in mkgmtime() function#104011 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-10-15 | $500 | – |
| Integer overflow in unserialize() (32-bits only)#104012 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-10-15 | $500 | – |
| heap buffer overflow in enchant_broker_request_dict()#104013 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-01-26 | $500 | – |
| libcurl duphandle read out of bounds#104014 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-11-05 | $1,000 | – |
| curl_setopt_array() type confusion#104015 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-04 | – | – |
| Dangling pointer in the unserialization of ArrayObject items#104016 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-05 | $1,000 | – |
| Arbitrary code execution in str_ireplace function#104017 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-04 | – | – |
| Files extracted from archive may be placed outside of destination directory#104019 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-08-05 | – | – |
| audioop.lin2adpcm Buffer Over-read#104020 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-26 | $500 | – |
| audioop.adpcm2lin Buffer Over-read#104021 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-28 | $500 | – |
| hotshot pack_string Heap Buffer Overflow#104022 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-27 | $500 | – |
| bytearray.find Buffer Over-read#104023 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-29 | $1,000 | – |
| array.fromstring Use After Free#104024 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-07-25 | $500 | – |
| use after free in load_newobj_ex#104025 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-07-02 | $500 | – |
| invalid pointer free() in phar_tar_process_metadata()#104026 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-05-22 | $500 | – |
| Memory Corruption in phar_parse_tarfile when entry filename starts with null#104027 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-05-12 | $500 | – |
| Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow)#104028 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-06-18 | – | – |
| PyFloat_FromString & PyNumber_Long Buffer Over-reads#104032 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-11-08 | $1,000 | – |
| tokenizer crash when processing undecodable source code#104033 | Valid | Internet Bug Bounty | No weakness recorded | – | 2015-11-14 | – | – |
| libphutil: removing bytes from a PhutilRope does not work as intended#105657 | Valid | Phabricator | No weakness recorded | – | 2015-12-16 | – | – |
| clickjacking#1207 | No longer public | Yahoo! | Misconfiguration and Insecure Design | – | 2015-08-14 | – | 1 |
| Authentication Bypass in Yahoo Groups#1209 | No longer public | Yahoo! | Authentication | – | 2015-08-14 | – | 1 |
| URL Redirection#1429 | No longer public | Yahoo! | Open Redirect | – | 2015-08-14 | – | 1 |
| Out of date version#5221 | No longer public | Yahoo! | Misconfiguration and Insecure Design | – | 2015-08-14 | – | 1 |
| Authentication Bypass due to Session Mismanagement#10912 | No longer public | Yahoo! | Authentication | – | 2015-08-14 | – | 1 |
| auth.mail.ru: XSS in login form#13195 | No longer public | Mail.ru | Cross-site Scripting | – | 2015-09-13 | $500 | 1 |
| api.video.mail.ru: XSS#13302 | No longer public | Mail.ru | Cross-site Scripting | – | 2015-09-13 | – | 1 |
| touch.afisha.mail.ru: XSS#13319 | No longer public | Mail.ru | Cross-site Scripting | – | 2015-09-13 | – | 1 |
| https://217.69.135.63/rb/: money.mail.ru sources disclosure#13482 | No longer public | Mail.ru | Information Disclosure | – | 2015-09-13 | $1,000 | 1 |
| my.mail.ru: HTTP Header Injection#16967 | No longer public | Mail.ru | No weakness recorded | – | 2015-09-13 | – | 1 |
| target.mail.ru: XSS#19334 | No longer public | Mail.ru | Cross-site Scripting | – | 2015-09-13 | – | 1 |
| target.mail.ru: XSS через Referer#19336 | No longer public | Mail.ru | Cross-site Scripting | – | 2015-09-13 | – | 1 |
| m.agent.mail.ru: Подделываем j2me app-descriptor#20391 | No longer public | Mail.ru | No weakness recorded | – | 2015-09-13 | $100 | 1 |
| files.mail.ru: HTTP Header Injection#20400 | No longer public | Mail.ru | No weakness recorded | – | 2015-09-13 | – | 1 |
| cloud.mail.ru: File upload XSS using Content-Type header#20720 | No longer public | Mail.ru | Cross-site Scripting | – | 2015-09-13 | $150 | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.