Race condition in performing retest allows duplicated payments Analysed #429026 Valid Race Conditions Medium 2018-12-27 – 240 Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form Analysed #418767 Valid Access Control Medium 2018-10-31 $10,000 208 IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier Analysed #449351 Valid Cross-site Scripting Medium 2018-11-27 $2,500 156 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature Analysed #334205 Valid Input Validation and Logic Medium 2018-04-18 $2,500 103 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately Analysed #452959 Valid Access Control Medium 2018-12-05 $2,500 90 Inline banner on Report page discloses whether organization runs a private program Analysed #452973 Valid Information Disclosure Low 2018-12-11 $500 67 Private program policy page still accessible after user left the program Analysed #386997 Valid Information Disclosure Medium 2018-08-12 $2,500 57 Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding Analysed #331691 Valid Input Validation and Logic Low 2018-04-18 $500 54 Extra program metrics disclosed via /PROGRAM_NAME json response Analysed #327088 Valid Information Disclosure Medium 2018-03-28 – 51 Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session Analysed #417382 Valid Authentication Low 2018-11-30 $500 47 Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot Analysed #357485 Valid Access Control Low 2018-06-27 $500 45 ImageMagick GIF coder vulnerability leading to memory disclosure Analysed #302885 Valid Information Disclosure Low 2018-02-07 $500 44 Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based" Analysed #427502 Valid Access Control Medium 2018-11-07 $2,500 43 Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature Analysed #397031 Valid Information Disclosure Low 2018-11-07 – 42 Private program email forwarding response invitation not expire after first use. Analysed #209140 Valid Misconfiguration and Insecure Design High 2018-05-30 – 38 Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion Analysed #297181 Valid Misconfiguration and Insecure Design Low 2018-01-22 $500 37 Updating payout preference to CurrencyCloud doesn't notify user via email Analysed #240083 Valid Misconfiguration and Insecure Design None 2018-01-31 $500 35 Accidental Access to Programs Information via SAML Login Analysed #438306 Valid No weakness recorded Critical 2018-11-14 – 34 Attacker can claim credentials for private program that has a published external program Analysed #449680 Valid Information Disclosure Medium 2018-11-29 – 32 CSRF at [Apply to this program] that lead to submit your request automatic with out any validations Analysed #334253 Valid Misconfiguration and Insecure Design Low 2018-07-05 – 30 A user can request a report to be retested even though the program has not been verified by HackerOne Analysed #448078 Valid Access Control Low 2018-12-27 – 27 User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program Analysed #350964 Valid Information Disclosure None 2018-06-27 – 24 Hacker can request mediation for published reports Analysed #412988 Valid Access Control Low 2018-11-27 $500 23 People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed Analysed #353310 Valid Information Disclosure Low 2018-06-25 $500 23 Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report Analysed #442843 Valid Access Control Low 2018-12-04 $500 21 Invalid Phabricator API token revealed through error message when escalating a report Analysed #335123 Valid Information Disclosure None 2018-06-27 $500 18