Team member with Program permission only can escalate to Admin permission Analysed #605720 Valid Access Control Medium 2019-06-26 – 268 Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status Analysed #654198 Valid Information Disclosure Low 2019-09-29 $500 213 Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint Analysed #536853 Valid Insecure Direct Object Reference Low 2019-04-23 – 161 Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report Analysed #410015 Valid Information Disclosure Medium 2019-04-24 $3,000 147 Banned researcher gets email updates on a private program. Analysed #271506 Valid No weakness recorded – 2019-05-18 – 139 Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible Analysed #685909 Valid Information Disclosure Medium 2019-11-08 – 127 Account recovery text message is sending a wrong domain to users. Analysed #549364 Valid Input Validation and Logic Low 2019-05-31 – 117 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. Analysed #397792 Valid Input Validation and Logic Medium 2019-01-02 – 117 Emails of invited collaborators are disclosed in full in payload for report participants Analysed #269230 Valid Information Disclosure Low 2019-04-09 – 112 ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages Analysed #713407 Valid Denial of Service Medium 2019-12-13 – 111 Password not checked when disabling 2FA on HackerOne Analysed #587910 Valid Misconfiguration and Insecure Design Low 2019-06-07 – 95 Race Condition in Flag Submission Analysed #454949 Valid Race Conditions Low 2019-07-22 – 94 Private information exposed through GraphQL filters Analysed #645299 Valid Information Disclosure Medium 2019-07-23 – 81 latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users Analysed #724944 Valid Information Disclosure Low 2019-11-10 – 79 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid Insecure Direct Object Reference Medium 2019-10-25 – 76 IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs Analysed #510759 Valid Insecure Direct Object Reference Low 2019-09-06 – 67 Any user with access to program can resume and suspend HackerOne Gateway Analysed #717716 Valid Insecure Direct Object Reference Medium 2019-10-21 – 65 Race condition in claiming program credentials Analysed #488985 Valid Race Conditions Low 2019-05-19 – 54 View HackerOne challenge scope before challenge begins Analysed #565736 Valid Access Control Low 2019-07-11 – 48 Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled Analysed #634679 Valid Access Control Medium 2019-07-05 – 47 Response program can display "eligible for bounty" in scope area in program policy Analysed #475660 Valid Input Validation and Logic Low 2019-01-30 $500 47 Response program can create bounty table Analysed #460920 Valid Input Validation and Logic Low 2019-01-07 $500 46 API Last Request Date/Time Not Updating Analysed #220774 Valid Input Validation and Logic Low 2019-05-19 – 45 Repeated mediation requests and multiple emails possible on a report. Analysed #156948 Valid No weakness recorded – 2019-04-11 $500 44 Hogging up all the resources on hackerone.com Analysed #125587 Valid Denial of Service Medium 2019-04-10 – 44 HackerOne Integrations Design Issue Analysed #172289 Valid Misconfiguration and Insecure Design Medium 2019-04-11 $500 36 IDOR in Bugs overview enables attacker to determine the date range a hackathon was active Analysed #663431 Valid Insecure Direct Object Reference Low 2019-12-13 – 33 Disclosure of h1 challenges name through the calendar Analysed #488643 Valid Information Disclosure Low 2019-01-30 – 29 Submitting report through Embedded Submission form gives user indefinite access to a profile Analysed #463828 Valid Input Validation and Logic Low 2019-01-03 $500 29 Homograph attack in escalate report Analysed #143975 Valid Misconfiguration and Insecure Design Low 2019-04-19 – 20 Lack of length validation on user address attribute Analysed #161947 Valid Denial of Service None 2019-04-11 – 18 Previous attachments can be referenced when creating a new report Analysed #129773 Valid Misconfiguration and Insecure Design Low 2019-04-12 – 17 Invited team member can disclosure slack channels Analysed #509574 Valid Information Disclosure Low 2019-04-05 $500 16 Moving a report to a different program doesn't reassign the Custom Field Values Analysed #511779 Valid Insecure Direct Object Reference Low 2019-04-25 – 15 CSV Injection at the CSV export feature Analysed #118582 Valid Command and Code Injection Low 2019-04-08 – 15 Missing rate limit on critical user actions e.g. reset password, change email, disable account. Analysed #157750 Valid Access Control – 2019-04-11 – 14