Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Directory Listing on grtp.co#109116 | Informative | Gratipay | Cryptography | – | 2017-08-21 | – | – |
| Full Path Disclosure in password lock#115422 | Informative | Paragon Initiative Enterprises | Information Disclosure | – | 2017-10-16 | – | – |
| Markdown parsing issue enables insertion of malicious tags#116512 | Informative | Gratipay | Cross-site Scripting | – | 2017-08-21 | – | – |
| Full Path Disclosure In EasyDB#119494 | Informative | Paragon Initiative Enterprises | Information Disclosure | – | 2017-10-16 | – | – |
| prevent %2f spoofed URLs in profile statement#128910 | Informative | Gratipay | Open Redirect | – | 2017-08-21 | – | – |
| Possible Blind SQL injection | Language choice in presentation#131047 | Informative | Gratipay | Misconfiguration and Insecure Design | – | 2017-08-21 | – | – |
| Submit a non valid syntax email#131053 | Informative | Gratipay | Misconfiguration and Insecure Design | – | 2017-08-21 | – | – |
| Usernames ending in .json are not restricted#161935 | Informative | Gratipay | Misconfiguration and Insecure Design | – | 2017-07-10 | – | – |
| x-xss protection header is not set in response header#162336 | Informative | Gratipay | Misconfiguration and Insecure Design | – | 2017-07-10 | – | – |
| Non-secure requests are not automatically upgraded to HTTPS#164419 | Informative | Legal Robot | No weakness recorded | – | 2017-12-19 | – | – |
| CSRF Issue#166231 | Informative | Legal Robot | Cross-Site Request Forgery | – | 2017-08-27 | – | – |
| Error Page Text Injection#176042 | Informative | Yelp | Misconfiguration and Insecure Design | None | 2017-11-09 | – | – |
| Possible content spoofing due to missing error page#179021 | Informative | Yelp | Misconfiguration and Insecure Design | Low | 2017-11-09 | – | – |
| [Yelp Blog] Backslash in search string causes JS error#179732 | Informative | Yelp | Misconfiguration and Insecure Design | None | 2017-11-09 | – | – |
| Clickjacking @ Main Domain[www.yelp.com]#197115 | Informative | Yelp | Misconfiguration and Insecure Design | Low | 2017-11-09 | – | – |
| Information disclosue in Android Application#201855 | Duplicate | Coinbase | Denial of Service | Low | 2017-08-30 | – | – |
| One of yelp.com url is redirecting to domain which is not yet purchased#207431 | Informative | Yelp | Open Redirect | – | 2017-11-09 | – | – |
| Missing/Breach of Internal Security Boundary - Access to Job Queue Results in Remote Code Execution#224198 | Informative | GitLab | Misconfiguration and Insecure Design | Low | 2017-06-28 | – | – |
| Full Path Disclosure in airship.paragonie.com '/cabins/'#226343 | Informative | Paragon Initiative Enterprises | No weakness recorded | – | 2017-10-16 | – | – |
| ClickJacking in editing business name#227837 | Informative | Yelp | Misconfiguration and Insecure Design | Low | 2017-11-09 | – | – |
| User can be fooled to Bookmark any restaurant by clickjacking#228295 | Informative | Yelp | Misconfiguration and Insecure Design | Low | 2017-11-09 | – | – |
| CSRF bug on password change#230436 | N/A | Coinbase | Cross-Site Request Forgery | – | 2017-08-28 | – | – |
| Non-secure requests are not automatically upgraded to HTTPS#241950 | Informative | Paragon Initiative Enterprises | Misconfiguration and Insecure Design | Low | 2017-10-16 | – | – |
| Improper parsing of input could lead to future XSS vulnerabilities in Sequences#243138 | Informative | Mixmax | Cross-site Scripting | Low | 2017-06-27 | – | – |
| SSl Weak Ciphers#244070 | Duplicate | Gratipay | Cryptography | Low | 2017-07-10 | – | – |
| Logout CSRF#244778 | Duplicate | WakaTime | Cross-Site Request Forgery | Low | 2017-08-29 | – | – |
| self cross site scripting#245762 | Informative | Gratipay | Cross-Site Request Forgery | Low | 2017-07-10 | – | – |
| Subdomain misconfiguration [mail.legalrobot.com]#250766 | Informative | Legal Robot | Misconfiguration and Insecure Design | – | 2017-07-31 | – | – |
| Device confirmation Flaw#254869 | Informative | Coinbase | No weakness recorded | None | 2017-08-02 | – | – |
| SSL BREACH attack (CVE-2013-3587)#254895 | Informative | Legal Robot | Cryptography | Low | 2017-07-30 | – | – |
| Special characters are not filtered out on profile fields#260838 | Informative | Legal Robot | No weakness recorded | None | 2017-08-26 | – | – |
| Improper error message#263681 | Informative | Legal Robot | No weakness recorded | Medium | 2017-09-01 | – | – |
| Error Page Content Spoofing or Text Injection#263866 | Duplicate | GSA Bounty | No weakness recorded | – | 2017-11-17 | – | – |
| Sql query disclosure,#267922 | Informative | Tor | Information Disclosure | Low | 2017-09-18 | – | – |
| Clickjacking https://blockstack.org/#269047 | Informative | Hiro | No weakness recorded | None | 2017-10-05 | – | – |
| Server Path Disclosure#272426 | Informative | Aspen | No weakness recorded | – | 2017-09-27 | – | – |
| Limited arbitrary text inclusion in user invite emails#278220 | Informative | Inflection | Input Validation and Logic | None | 2017-11-29 | – | – |
| Broken link for stale DNS entry may be leveraged for Phishing, Misinformation, Serving Malware#279351 | Informative | Gratipay | No weakness recorded | None | 2017-10-18 | – | – |
| Crashes/Buffer at 0x2C0086,name=PBrowser::Msg_Destroy#281682 | Informative | Tor | Memory Corruption | Medium | 2017-10-24 | – | – |
| Cross-domain linkability when system time changed in Tor Browser#282339 | Informative | Tor | Information Disclosure | Low | 2017-10-26 | – | – |
| A10 – Unvalidated Redirects and Forwards#283269 | Informative | Infogram | Open Redirect | Low | 2017-11-09 | – | – |
| Session does't get expired after changing the password in https://readthedocs.org#290889 | Informative | Aspen | No weakness recorded | – | 2017-11-16 | – | – |
| Reflected Cross Site Script in imtportal.gm.com#120622 | Duplicate | General Motors | Cross-site Scripting | – | 2017-06-09 | – | 1 |
| Content Spoof in opel.es.wpsegment2.gm.com#121100 | Valid | General Motors | Misconfiguration and Insecure Design | – | 2017-06-09 | – | 1 |
| Inaccurate Payment receipt#121417 | Informative | Coinbase | No weakness recorded | – | 2017-08-30 | – | 1 |
| PHP 5.4.45 is Outdated and Full of Preformance Interupting Arbitrary Code Execution Bugs#131452 | N/A | Gratipay | Misconfiguration and Insecure Design | – | 2017-08-21 | – | 1 |
| Unvalidated redirect on user profile website#143265 | Informative | Eternal | Open Redirect | – | 2017-05-18 | – | 1 |
| Full Page Caching Stored XSS Vulnerability#148300 | Informative | Concrete CMS | Cross-site Scripting | – | 2017-04-11 | – | 1 |
| Email spoofing possible via Legal Robot domain#163475 | Informative | Legal Robot | Misconfiguration and Insecure Design | – | 2017-01-21 | – | 1 |
| Insecure Transportation Security Protocol Supported (TLS 1.0)#163812 | Informative | Gratipay | Misconfiguration and Insecure Design | – | 2017-07-10 | – | 1 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.