Ability to invite a new member on Sandbox Program #1088966 Valid Input Validation and Logic Low 2021-04-05 – 44 Disclosing a private program in an external link if program is paused #418474 Valid No weakness recorded Low 2019-06-28 $500 44 ImageMagick GIF coder vulnerability leading to memory disclosure #302885 Valid Information Disclosure Low 2018-02-07 $500 44 Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com #199779 Valid Misconfiguration and Insecure Design Low 2017-03-26 – 44 (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation #171398 Valid Cross-site Scripting Low 2016-10-27 – 44 Repeated mediation requests and multiple emails possible on a report. #156948 Valid No weakness recorded – 2019-04-11 $500 44 Hogging up all the resources on hackerone.com #125587 Valid Denial of Service Medium 2019-04-10 – 44 Upload profile photo from URL #713 Valid Server-Side Request Forgery – 2014-02-15 – 44 Hackers two email disclosed on submission at hackerone hactivity #2134874 Valid Information Disclosure – 2023-10-18 – 43 Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based" #427502 Valid Access Control Medium 2018-11-07 $2,500 43 HackerOne support disclosing report state without checking user identity #356566 Valid No weakness recorded Low 2018-06-02 $500 43 GraphQL node interface for ActiveResource models lacks encoding for resource identifier, enabling parameter injection in Payments backend #800231 Valid Information Disclosure Medium 2020-05-11 – 42 User login page doesn't implement any form of rate limiting #410451 Valid Authentication Low 2019-01-04 – 42 Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature #397031 Valid Information Disclosure Low 2018-11-07 – 42 IE 11 Self-XSS on Jira Integration Preview Base Link #212721 Valid Cross-site Scripting Low 2017-03-29 $750 42 AWS S3 bucket writeable for authenticated aws users #128088 Valid Authentication – 2016-04-05 – 42 Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs #1219011 Valid Information Disclosure Low 2021-06-30 $500 41 The possibility of disrupting the normal operation of frontend using markdown #1138668 Valid Denial of Service Low 2021-08-24 – 41 User with privilege to maintain External Programs can update certain churned HackerOne programs #411930 Valid Access Control Low 2018-10-25 $500 41 Path traversal leading to limited CSRF on GET requests on two endpoints #301862 Valid No weakness recorded – 2019-04-05 – 41 DNS Cache Poisoning #487 Valid No weakness recorded – 2014-01-09 $100 41 HTML injection in email at https://www.hackerone.com/ #1374017 Valid Command and Code Injection Low 2023-05-12 – 40 Business Logic error leads to bypass 2FA requirement #2571981 Duplicate Input Validation and Logic High 2024-07-11 – 39 Private program disclosure through notifications #1234746 Valid Access Control Low 2021-08-05 $500 39 Disclosure of Program email Title Report when being removed as contributor. Bypass for Report #645264 #669776 Valid Information Disclosure Low 2019-09-06 – 39 Open redirect vulnerability in index.php #439075 Valid Open Redirect None 2019-02-03 – 39 Team object in GraphQL that have a published external program may expose existence of a private program #347937 Valid Information Disclosure None 2018-07-04 – 39 Report invitation links not restricted to any existing user #214839 Valid Information Disclosure Low 2017-05-23 $500 39 Private program email forwarding response invitation not expire after first use. #209140 Valid Misconfiguration and Insecure Design High 2018-05-30 – 38 Reset the 2FA of the user which can lead to Account Takeover #2492631 Duplicate Access Control Medium 2024-07-11 – 37 Two-factor authentication bypass lead to information disclosure about the program and all hackers participate #2486086 Duplicate Information Disclosure High 2024-07-11 – 37 Ability to bulk submit reports via query named based batching #2166697 Valid Misconfiguration and Insecure Design Low 2024-06-19 $500 37 User's who are banned from program can still be invited to the new reports as collaborators #1131306 Valid Input Validation and Logic Low 2021-09-22 – 37 Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion #297181 Valid Misconfiguration and Insecure Design Low 2018-01-22 $500 37 Invitation token leaks to https://bat.bing.com #301526 Valid Information Disclosure Low 2018-01-11 – 36 HackerOne reports escalation to JIRA is CSRF vulnerable #226418 Valid Cross-Site Request Forgery Medium 2017-08-30 $500 36 Changing Victim's JIRA Integration Settings Through Multiple Bugs #226199 Valid Input Validation and Logic Medium 2017-05-23 $1,000 36 HackerOne Integrations Design Issue #172289 Valid Misconfiguration and Insecure Design Medium 2019-04-11 $500 36 Broken Authentication and session management OWASP A2 #284 Valid Authentication – 2014-01-09 – 36 [Bypass] Ability to invite a new member in sandbox Organization #1486417 Valid Input Validation and Logic Medium 2022-04-14 – 35 Updating payout preference to CurrencyCloud doesn't notify user via email #240083 Valid Misconfiguration and Insecure Design None 2018-01-31 $500 35 Information leakage of private program #159526 Valid Information Disclosure – 2016-08-18 $500 35 Program Email Nofication settings ignored when being added as an external contributor #645264 Valid Information Disclosure Low 2019-08-07 – 34 Accidental Access to Programs Information via SAML Login #438306 Valid No weakness recorded Critical 2018-11-14 – 34 Timing attack towards endpoints on the web without CSRF #348168 Duplicate Information Disclosure Low 2018-12-27 – 34 CSP not consistently applied #321 Valid Cross-site Scripting – 2013-11-30 – 34 Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation #2719622 Informative No weakness recorded Medium 2024-09-19 – 33 Bypassing Two-Factor Authentication via Account Deactivation and Password Reset #2543342 Duplicate Access Control None 2024-07-11 – 33 Internal machine learning API endpoint for CWE classification is vulnerable to path traversal #2032778 Valid File and Path Handling Medium 2023-07-05 – 33 Lack warning label when receiving a letter #1128701 Valid Input Validation and Logic Low 2021-05-13 – 33