Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spam #808755 Valid Input Validation and Logic Low 2020-05-15 – 7 Ajouter le même utilisateur que celui déjà inscrit dans les équipes #378209 Informative No weakness recorded – 2018-07-17 – 7 Open redirect deceive in hackerone.com via another open redirect link. #296706 Informative Open Redirect Low 2017-12-13 – 7 Deleted name still present via mouseover functionality for user accounts #127914 Valid Information Disclosure – 2016-04-21 – 7 Null byte injection #116189 Valid No weakness recorded – 2016-02-23 – 7 Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants #107336 Valid Access Control – 2016-01-27 – 7 Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports #106084 Valid Authentication – 2015-12-29 $500 7 Send AJAX request to external domain #97191 Valid Cross-site Scripting – 2015-11-14 – 7 Accessing title of the report of which you are marked as duplicate #75556 Valid Authentication – 2015-07-17 $500 7 "learn more here", reward email - domain expired. #52532 Valid Open Redirect – 2015-03-23 – 7 In markdown, parsing things like @danlec and #46072 after links is unsafe #46312 Valid No weakness recorded – 2015-07-04 – 7 Accepting Invalid characters on email address #3991 Valid Misconfiguration and Insecure Design – 2016-04-25 – 7 CSV injection in the credentials export #1131887 Valid Misconfiguration and Insecure Design None 2021-09-22 – 6 Partial disclosure of undisclosed programs through <meta> tags #302620 Informative Information Disclosure – 2018-01-11 – 6 DOS Report FILE html inside <code> in markdown #127827 Valid Denial of Service – 2016-05-21 – 6 New hacktivity view discloses report IDs of non-public reports #127235 Valid No weakness recorded – 2016-04-26 – 6 Websites opened from reports can change url of report page #124889 Valid Cross-Site Request Forgery – 2016-04-21 – 6 Denial of Service any Report #118663 Valid Denial of Service – 2016-03-09 – 6 Private Program Disclosure in /:handle/reports/draft.json endpoint #116032 Valid Authentication – 2016-02-16 – 6 Multiple issues with Markdown and URL parsing #113070 Valid Misconfiguration and Insecure Design – 2016-04-21 $500 6 Signals get affected once reports closed as self #108928 Valid Misconfiguration and Insecure Design – 2016-04-25 – 6 profile cover can also load external URL's #99687 Valid Misconfiguration and Insecure Design – 2015-12-02 – 6 Cross-domain AJAX request #97948 Valid Open Redirect – 2015-11-14 – 6 Invitation is not properly cancelled while inviting to bug reports. #66151 Valid Authentication – 2015-07-10 – 6 Logical Issue (Boosting Reputation points) #60429 Informative No weakness recorded – 2015-07-21 – 6 Reopen Disable Accounts/ Hidden Access After Disable #59659 Valid Authentication – 2015-06-08 – 6 Making any Report Failed to load #59369 Valid Denial of Service – 2015-05-09 – 6 Open-redirect on hackerone.com #57163 Valid Open Redirect – 2015-04-23 – 6 SPF whitelist of mandrill leads to email forgery #56742 Valid Authentication – 2015-06-08 – 6 Auto Approval of Invitation to join Team as a Team member #49566 Valid Misconfiguration and Insecure Design – 2015-03-11 – 6 Team member invitations to sandboxed teams are not invalidated consistently (v2) #48422 Valid Access Control – 2015-02-27 – 6 Markdown code block sequence makes report unreadable #46952 Valid No weakness recorded – 2015-06-29 – 6 Enumeration/Guess of Private (Invited) Programs #32990 Valid Misconfiguration and Insecure Design – 2015-05-09 – 6 Redirect FILTER bypass in report/comment #28865 Valid Open Redirect – 2014-10-19 $500 6 Flooding mailbox of user #10109 Informative Misconfiguration and Insecure Design – 2014-04-30 – 6 creating titleless and non-closable bugs #6350 Valid No weakness recorded – 2014-04-17 – 6 Securing sensitive pages from SearchBots #3986 Valid Misconfiguration and Insecure Design – 2014-04-20 – 6 harvesting attack on user registration #2193 Informative No weakness recorded – 2014-05-19 – 6 Information Disclosure which violate program privacy #313075 Informative Information Disclosure Low 2018-02-20 – 5 HackerOne Important Emails Notification are sent in clear-text #127175 Valid Authentication – 2016-05-19 – 5 Possible XSS #123278 Informative Cross-site Scripting – 2016-04-21 – 5 Private Program Disclosure in /:handle/settings/allow_report_submission.json endpoint #116798 Valid Information Disclosure – 2016-02-24 – 5 attack in not an authorized user #111676 Valid Denial of Service – 2016-02-16 – 5 Minimum bounty of a private program is visible for users that were removed from the program #94336 Valid Information Disclosure – 2015-10-21 – 5 Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc. #90367 Valid Information Disclosure – 2015-09-25 – 5 mailto: link injection on https://hackerone.com/directory #66262 Valid Misconfiguration and Insecure Design – 2015-06-10 – 5 Potential denial of service in hackerone.com/<program>/reward_settings #63865 Valid Denial of Service – 2015-06-10 – 5 Email Notification should be get while changing Paypal Email #62827 Valid Authentication – 2015-06-19 – 5 Content Spoofing - External Link Warning Page #60402 Valid Misconfiguration and Insecure Design – 2015-05-11 – 5 Homograph Attack #59372 Valid Open Redirect – 2015-05-09 – 5