Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Middleware Authentication Bypass on IBM PortalAnalysed#3088290 | Valid | Command and Code Injection | Critical | 2025-05-02 | – | 80 |
| SSRF via host header let access localhost via https://go.dialexa.comAnalysed#2696271 | Valid | No weakness recorded | Medium | 2024-10-03 | – | 75 |
| S3 Bucket Takeover on apptio endpointAnalysed#2498255 | Valid | Access Control | Medium | 2024-06-21 | – | 72 |
| SSRF and secret key disclosure found on Turbonomic endpointAnalysed#2697592 | Valid | Server-Side Request Forgery | High | 2024-09-19 | – | 71 |
| [RCE] Remote Code Execution via React Server Components Vulnerability CVE-2025-55182Analysed#3458235 | Valid | Command and Code Injection | Critical | 2025-12-18 | – | 67 |
| RXSS in hidden parameterAnalysed#2090964 | Valid | Cross-site Scripting | Medium | 2024-04-23 | – | 65 |
| XSS Refelected on jazz.netAnalysed#2338285 | Valid | Cross-site Scripting | Medium | 2024-02-29 | – | 64 |
| Path Traversal Vulnerability found on IBM CloudAnalysed#3060373 | Valid | File and Path Handling | Critical | 2025-05-07 | – | 63 |
| Remote Code Execution identified on IBM endpoint.Analysed#3463045 | Valid | No weakness recorded | Critical | 2025-12-31 | – | 60 |
| Exposed Logs and Bearer Tokens on Test EndpointAnalysed#2844797 | Valid | Information Disclosure | – | 2024-12-12 | – | 57 |
| Insecure Direct Object Reference Protection bypass by changing HTTP method in IBM Your Learning endpoint.Analysed#2456603 | Valid | Insecure Direct Object Reference | Critical | 2024-05-01 | – | 57 |
| IDOR in upload videos of a Channel on https://video.ibm.comAnalysed#2085185 | Valid | Insecure Direct Object Reference | Critical | 2023-08-31 | – | 57 |
| SSRF and secret key disclosure found on Turbonomic endpointAnalysed#2697601 | Valid | Server-Side Request Forgery | High | 2024-09-19 | – | 56 |
| SQL Injection in IBM access control panel & Broken access in admin panelAnalysed#1355817 | Valid | SQL Injection | Critical | 2021-10-18 | – | 54 |
| XSS in Aspera documentation websiteAnalysed#2308491 | Valid | Cross-site Scripting | Medium | 2024-05-06 | – | 52 |
| Information disclosure on IBM training service endpointAnalysed#3051155 | Valid | Insecure Direct Object Reference | – | 2025-04-29 | – | 49 |
| IBM OpenPages vulnerable to exposure of sensitive informationAnalysed#2501986 | Valid | Authentication | Medium | 2024-10-01 | – | 49 |
| POST based Cross-Site Scripting on IBM research endpointAnalysed#2899380 | Valid | Cross-site Scripting | Medium | 2025-01-23 | – | 44 |
| sql injection via https://setup.p2p.ihost.com/Analysed#1567516 | Valid | SQL Injection | Critical | 2022-06-17 | – | 41 |
| Weak credentials found in Jenkins endpointAnalysed#2954547 | Valid | No weakness recorded | Critical | 2025-02-05 | – | 40 |
| Information disclosure identified on IBM endpoint.Analysed#2402842 | Valid | Information Disclosure | Medium | 2025-07-08 | – | 39 |
| XSS in IBM InfoCenterAnalysed#2343548 | Valid | Cross-site Scripting | Medium | 2024-07-17 | – | 39 |
| Jenkins server access due to weak passwordAnalysed#2139047 | Valid | Authentication | High | 2024-02-29 | – | 39 |
| SQL Injection vulnerability found on IBM.com subdomainAnalysed#3730301 | Valid | SQL Injection | – | 2026-10-16 | – | 36 |
| Improper Authentication on Alertmanager instanceAnalysed#2292236 | Valid | Authentication | Medium | 2024-02-29 | – | 36 |
| SQL Injection found on ibm.com subdomainAnalysed#3662095 | Valid | SQL Injection | Critical | 2026-10-12 | – | 33 |
| response manipulation leads to bypass in register at employee website than 0 click account takeoverAnalysed#1994227 | Valid | Authentication | Critical | 2023-06-21 | – | 32 |
| Cleartext storage of sensitive information at https://staging.status.ai-apps-comms.ibm.com/env can lead to account takeover of several IBM employeesAnalysed#1670586 | Valid | Cryptography | Critical | 2022-09-09 | – | 31 |
| Reflected Cross-Site Scripting (XSS) found on IBM.com domainAnalysed#3664261 | Valid | Cross-site Scripting | – | 2026-06-15 | – | 29 |
| Subdomain Takeover Affecting at vex.weather.comAnalysed#1954364 | Valid | Authentication | Critical | 2023-05-10 | – | 26 |
| Unauthorized vertical privilege escalation vulnerability found on ibm.com endpointAnalysed#3909372 | Valid | Access Control | – | 2026-08-28 | – | 25 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.