TeamProfile exposes partially sensitive information through GraphQL #389600 Valid Information Disclosure Low 2018-08-08 – 60 HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information #378122 Valid Information Disclosure None 2018-07-26 – 60 Stored XSS on https://events.hackerone.com #1028332 Valid Cross-site Scripting None 2021-03-26 – 59 Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects #781175 Valid Access Control Medium 2020-03-20 – 59 Team object exposes amount of participants in a private program to non-invited users #380317 Valid Information Disclosure Medium 2018-07-20 – 59 Report Private Links Leaks to Google Analytics via Query String Param #269479 Valid Information Disclosure – 2017-10-25 – 59 Private program name disclosure in the invitation mail for another program #2228413 Valid Information Disclosure Low 2023-12-08 – 58 HackerOne Staging uses Production data for testing #1392511 Valid Information Disclosure Low 2021-11-05 – 58 Subdomain takeover #3 at info.hacker.one #217358 Valid Access Control – 2017-06-21 – 58 Organization members can delete reports in teams they have no access to #2203432 Valid Access Control Medium 2023-11-22 – 57 Changing the 2FA secret key and backup codes without knowing the 2FA OTP #1139535 Valid Other weaknesses Medium 2021-05-06 – 57 Private program policy page still accessible after user left the program #386997 Valid Information Disclosure Medium 2018-08-12 $2,500 57 Invalid Host detection at https://hackerone.com/redirect #278095 Valid Misconfiguration and Insecure Design – 2017-12-03 – 57 Register & create a ticket as somebody else on HackerOne Support #2082680 Valid Misconfiguration and Insecure Design None 2023-07-31 – 56 New Search Feature: Search for non-public words in limited disclosure reports #2213251 Valid Information Disclosure Medium 2023-10-25 – 55 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports. #2000000 Valid Misconfiguration and Insecure Design Low 2023-07-11 – 54 Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io #1028345 Valid Open Redirect None 2021-03-26 – 54 Race condition in claiming program credentials #488985 Valid Race Conditions Low 2019-05-19 – 54 Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details #447930 Valid Insecure Direct Object Reference High 2019-01-11 – 54 Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding #331691 Valid Input Validation and Logic Low 2018-04-18 $500 54 Hacker email disclosed on submission at hackerone hactivity #2215434 Valid Information Disclosure Low 2023-10-24 $100 53 Open Redirection in index.php page #320376 Valid Open Redirect None 2018-03-07 – 53 New link opening method makes hackerone vulnerable to tabnabbing #1159398 Valid Open Redirect Low 2021-07-07 – 51 Extra program metrics disclosed via /PROGRAM_NAME json response #327088 Valid Information Disclosure Medium 2018-03-28 – 51 GIF flooding #400 Valid Denial of Service – 2013-11-30 $250 51 Staff and Triage can modify the initial post of a report, including of already disclosed reports #2096271 Valid Access Control Medium 2023-08-28 – 50 Program managers can see draft reports using Export Reports feature #1664920 Valid Input Validation and Logic Low 2023-05-18 – 50 Total bounties paid amount is disclosed because of redesign of the Program Profiles #640488 Valid Information Disclosure Low 2019-08-02 – 50 Subdomain takeover #4 at info.hacker.one #220002 Valid Access Control – 2017-06-21 – 50 Websites opened from reports can change url of report page #189726 Valid Open Redirect – 2017-02-25 – 50 Attachment in published HackerOne report exposure private program #1869613 Valid Information Disclosure Low 2023-06-07 – 49 Bypass comment restriction #2679108 Informative Access Control Medium 2024-09-19 – 48 View HackerOne challenge scope before challenge begins #565736 Valid Access Control Low 2019-07-11 – 48 Domain spoofing in redirect page using RTLO #299403 Valid Open Redirect Low 2018-01-30 – 48 Real impersonation #280 Valid No weakness recorded – 2013-11-30 – 48 Missing SPF for hackerone.com #120 Valid Misconfiguration and Insecure Design – 2014-01-09 – 48 Two factor authentication bypass #2463279 Duplicate No weakness recorded Medium 2024-07-11 – 47 information disclosure of another company bug on video. #1886143 Valid Information Disclosure Low 2023-03-12 – 47 Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled #634679 Valid Access Control Medium 2019-07-05 – 47 Response program can display "eligible for bounty" in scope area in program policy #475660 Valid Input Validation and Logic Low 2019-01-30 $500 47 Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session #417382 Valid Authentication Low 2018-11-30 $500 47 Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information #1242680 Valid Information Disclosure Low 2021-06-24 – 46 "Bounty splitting enabled" can discloses if public VDPs are running private VRP #1103812 Valid No weakness recorded Low 2021-03-18 – 46 Disclosure of the name of a program that has a private part with an external link #871142 Valid Information Disclosure Low 2020-05-22 $500 46 Response program can create bounty table #460920 Valid Input Validation and Logic Low 2019-01-07 $500 46 Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification #242964 Valid Input Validation and Logic – 2017-11-01 – 46 HackerOne Code: a live password reset token reaches Datadog RUM, and the same session records the account it unlocks #4071670 Valid Authentication Low 2026-10-08 $200 45 Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot #357485 Valid Access Control Low 2018-06-27 $500 45 Content Security Policy not applied to error pages at multiple HackerOne endpoints #250729 Valid Misconfiguration and Insecure Design – 2017-12-12 – 45 API Last Request Date/Time Not Updating #220774 Valid Input Validation and Logic – 2019-05-19 – 45