Disclosed bug bounty reports

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Unauthorized Team members viewing#123572	Informative	Authentication	–	2016-07-02	–	12
Improve signals in reputation#106305	Valid	Misconfiguration and Insecure Design	–	2016-01-07	–	12
Open redirect in "Language change".#52035	Valid	Open Redirect	–	2015-06-19	$500	12
homograph attack. IDNs displayed in unicode in bug reports and on external link warning page#29491	Valid	Misconfiguration and Insecure Design	–	2014-10-09	$500	12
Verbose PHP error messages exposed on a blog article#439174	Valid	Information Disclosure	None	2019-04-10	–	11
CSRF possible when SOP Bypass/UXSS is available#103787	Valid	Cross-Site Request Forgery	–	2015-12-30	$2,500	11
No email verification on username change#29331	Valid	Information Disclosure	–	2014-11-17	$500	11
All Active user sessions should be deleted when user change his password!#9950	Valid	Misconfiguration and Insecure Design	–	2016-04-25	$100	11
A password reset page does not properly validate the authenticity token at the server side.#742	Valid	Cross-Site Request Forgery	–	2014-04-19	$100	11
Flawed account creation process allows registration of usernames corresponding to existing file names#477	Valid	No weakness recorded	–	2014-04-19	$100	11
Privilege escalation..., or not?!#345	Valid	Misconfiguration and Insecure Design	–	2015-06-08	–	11
RTL override symbol not stripped from file names#298	Valid	Misconfiguration and Insecure Design	–	2015-05-28	–	11
While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal)#307424	Informative	Misconfiguration and Insecure Design	Low	2018-01-23	–	10
Missing Password Confirmation at a Critical Function (Payout Method)#303299	Informative	Misconfiguration and Insecure Design	Medium	2018-01-10	–	10
Reward Money Leakage#149435	Informative	Information Disclosure	–	2016-08-09	–	10
New hacktivity view discloses report IDs of non-public reports#127620	Valid	Misconfiguration and Insecure Design	–	2016-04-05	$500	10
CSV Injection via the CSV export feature#111192	Valid	Command and Code Injection	–	2016-02-16	–	10
CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain#47472	Valid	Cross-Site Request Forgery	–	2015-02-26	$2,000	10
Reflected File Download#39658	Valid	Misconfiguration and Insecure Design	–	2016-04-25	–	10
Session Hijacking attack (Different Scenario)#19640	Informative	Authentication	–	2014-07-17	–	10
LinkedIN URL should be HTTPS#1093	Valid	No weakness recorded	–	2016-05-18	–	10
GraphQL sessions aren't immediately invalidated when user password is changed#283847	Valid	Misconfiguration and Insecure Design	–	2017-11-30	–	9
Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page#280770	Valid	Information Disclosure	None	2017-11-01	–	9
Information disclosure via policy update notifications after removal from program#177484	Valid	Information Disclosure	Low	2016-10-29	–	9
Disclosure of external users invited to a specific report#157699	Valid	Information Disclosure	–	2016-09-01	–	9
Reputation Manipulation (Theoretical)#132057	N/A	Misconfiguration and Insecure Design	–	2016-04-19	–	9
Private program activity timeline information disclosure#116029	Valid	Authentication	–	2016-03-16	–	9
Limited CSRF bypass.#99708	Valid	Cross-Site Request Forgery	–	2015-12-02	$500	9
Reflected Filename Download#54034	Valid	Command and Code Injection	–	2016-04-25	–	9
"early preview" programs disclosure#29185	Informative	Information Disclosure	–	2015-01-21	–	9
Change Any username and profile link in hackerone#25281	Valid	Access Control	–	2014-09-25	$100	9
Anti-MIME-Sniffing header X-Content-Type-Options header has not been set.#9479	Valid	Misconfiguration and Insecure Design	–	2015-04-28	–	9
Information disclosure#350432	Duplicate	Information Disclosure	Low	2018-12-27	–	8
Leakage badges on disabled user#325594	Informative	Information Disclosure	Low	2018-03-15	–	8
Private Program all members disclosed#283309	Duplicate	Information Disclosure	–	2017-11-16	–	8
External programs revealing info#124929	Valid	Authentication	–	2016-04-01	$1,500	8
External links should use rel="noopener" or use the redirect service#124620	Valid	Open Redirect	–	2016-04-05	–	8
Increase number of bugs by sending duplicate of your own valid report#116951	Valid	Misconfiguration and Insecure Design	–	2016-04-25	–	8
Information leakage - Private reports cached by Google#80118	Informative	Information Disclosure	–	2018-07-23	–	8
Restrict any user from logging into his account.#48416	Valid	Authentication	–	2015-03-24	–	8
Insecure Direct Object Reference vulnerability#46397	Valid	Misconfiguration and Insecure Design	–	2015-02-20	$500	8
Logic Issue with Reputation: Boost Reputation Points#36211	Valid	Misconfiguration and Insecure Design	–	2015-04-28	–	8
Ability to see common response titles of other teams (limited)#31383	Valid	Information Disclosure	–	2014-10-15	–	8
Redirect while opening links in new tabs#23386	Valid	Open Redirect	–	2014-09-12	$500	8
Email changing#18846	Informative	No weakness recorded	–	2014-08-28	–	8
javascript: and mailto: links are allowed on users' profiles#4184	Valid	Cross-site Scripting	–	2015-05-13	–	8
Adding an user email address to the list before confirming.#3923	Informative	Misconfiguration and Insecure Design	–	2014-06-11	–	8
Weird Bug - Ability to see partial of other user's notification#2584	Valid	No weakness recorded	–	2014-04-19	–	8
Autocomplete enabled in Paypal preferences#842	Valid	Misconfiguration and Insecure Design	–	2015-05-28	–	8
Report title autocompletion#263	Valid	Information Disclosure	–	2015-06-08	–	8

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,187 analysed so far), which can be wrong. Data as of 2026-11-15.