Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
SQL Injection vulnerability found on ibm.com endpointAnalysed#3578842	Valid	SQL Injection	Critical	2026-03-12	–	137
Potential Subdomain Takeover on IBM.com domain.Analysed#3592387	Valid	Access Control	High	2026-03-24	–	82
Unauthenticated Remote Access to Testing EndpointAnalysed#2192984	Valid	Access Control	Critical	2023-12-04	–	67
Remote Code Execution at https://169.38.86.185/ (edst.ibm.com)Analysed#1379130	Valid	Command and Code Injection	Critical	2021-11-04	–	49
IBM Aspera HTTP Gateway stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.Analysed#3340797	Valid	Information Disclosure	High	2026-04-27	–	46
jazz.net - publicly accessible .svn repositoriesAnalysed#2398335	Valid	Information Disclosure	–	2024-08-16	–	43
Reflected XSS and Blind out of band command injection at subdomain dstuid-ww.dst.ibm.comAnalysed#410334	Valid	Command and Code Injection	High	2022-02-04	–	42
IBM Maximo Asset Management could allow a remote attacker to bypass authentication due to improper access controlsAnalysed#1933304	Valid	Access Control	Medium	2024-02-06	–	37
SQL injection in URL path processing on www.ibm.comAnalysed#1527284	Valid	SQL Injection	Critical	2022-05-06	–	35
Public Jenkins instance with /script enabledAnalysed#1492447	Valid	Access Control	Critical	2022-03-11	–	16

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.