IDOR in Bugs overview enables attacker to determine the date range a hackathon was active #663431 Valid Insecure Direct Object Reference Low 2019-12-13 – 33 Open Redirection in [https://www.hackerone.com/index.php] #562417 Valid Open Redirect None 2019-05-08 – 33 IDOR on Program Visibilty (Revealed / Concealed) against other team members #291721 Duplicate Insecure Direct Object Reference Medium 2017-11-23 – 33 Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program #2569993 Informative Access Control Low 2024-07-11 – 32 Private information exposed through GraphQL search endpoints aggregates #1838329 Valid Information Disclosure Medium 2023-01-19 – 32 Hackers can reveal the names of private programs that have an external link and Enterprise Product Edition #1130235 Valid Information Disclosure Low 2021-08-24 – 32 Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml #1028396 Valid Cross-site Scripting None 2021-03-26 – 32 Attacker can claim credentials for private program that has a published external program #449680 Valid Information Disclosure Medium 2018-11-29 – 32 Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties #395518 Valid Information Disclosure Low 2018-08-17 – 32 View Any Program's Team Members through GET https://hackerone.com/invitations/ #283014 Valid Information Disclosure Medium 2017-11-01 $1,000 32 Invitation tokens leak to Google Analytics #237262 Valid Information Disclosure Low 2017-07-16 – 32 RCE in profile picture upload #135072 Valid Command and Code Injection – 2016-06-08 – 32 Improper Authentication - 2FA OTP Reusable #2529780 Duplicate Authentication High 2024-07-11 – 31 Information disclosure - Feedback is accessible on Public profile even after 'disallowed' at https://hackerone.com/settings/feedback #1264725 Valid Information Disclosure Low 2021-08-03 – 30 Read-only team members can read all properties of webhooks #818848 Valid Access Control Low 2020-04-29 – 30 A team member of the program with Report rights can ban the Admin #816143 Valid Input Validation and Logic Low 2020-05-15 – 30 HackerOne Pentesters can access any structured scope object through GraphQL node interface #781150 Valid Access Control High 2020-03-11 – 30 A small set of users were assigned someone else's payout preference #498845 Valid Information Disclosure Low 2019-02-20 – 30 CSRF at [Apply to this program] that lead to submit your request automatic with out any validations #334253 Valid Misconfiguration and Insecure Design Low 2018-07-05 – 30 Blind SSRF in "Integrations" by abusing a bug in Ruby's native resolver. #287245 Valid Server-Side Request Forgery – 2017-11-09 – 30 Non-secure requests are not automatically upgraded to HTTPS #158186 Valid No weakness recorded – 2016-08-19 – 30 Ability to escape database transaction through SQL injection, leading to arbitrary code execution #1663299 Valid SQL Injection High 2022-08-09 – 29 Attachment references in markdown don't warn before downloading #1386277 Valid Open Redirect Low 2022-02-25 – 29 Editing Pentest Summary Report Answers After Submitting Them #1139528 Valid Other weaknesses Low 2021-05-06 – 29 Dangling cloud instance at vpn.inverselink.com #1112679 Valid Input Validation and Logic Low 2021-03-11 $500 29 Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation #981036 Informative Input Validation and Logic Low 2021-09-20 – 29 Disclosure of h1 challenges name through the calendar #488643 Valid Information Disclosure Low 2019-01-30 – 29 Submitting report through Embedded Submission form gives user indefinite access to a profile #463828 Valid Input Validation and Logic Low 2019-01-03 $500 29 Program profile metrics endpoint contains mean time to triage, even when turned off #289568 Valid Information Disclosure Medium 2017-11-14 – 29 Information leakage via CSV when content is valid JavaScript #207266 Valid Cross-Site Request Forgery Low 2017-05-23 – 29 2FA Bypass via Leaked Cookies #2479622 Informative Authentication Medium 2024-07-11 – 28 Session Not Expire / 2FA Bypass #2469706 Informative Authentication Medium 2024-07-11 – 28 Private invitation links/tokens leak to third-party analytics site #1491127 Valid Information Disclosure Low 2022-04-05 $500 28 Can read features from any user #316810 Valid Information Disclosure Medium 2018-03-12 $250 28 Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session #111968 Valid Open Redirect – 2016-02-24 – 28 Email spoofing #575 Valid Misconfiguration and Insecure Design – 2015-05-28 – 28 A user can request a report to be retested even though the program has not been verified by HackerOne #448078 Valid Access Control Low 2018-12-27 – 27 Program profile_metrics.json contains time to triage for deptofdefense even it's turned off #318399 Valid Information Disclosure None 2018-03-09 $250 27 Able To Check The Exact Bounty Balance of any Bug Bounty Program #293593 Duplicate Information Disclosure Medium 2017-12-06 – 27 Report redaction doesn't apply to report title update activities #196358 Valid Misconfiguration and Insecure Design Low 2017-02-25 – 27 Switching the user to the attacker's account #727 Valid Cross-Site Request Forgery – 2014-02-20 $150 27 SAML Response Reuse on hackerone.com/users/saml/auth #888930 Valid Authentication Low 2020-07-24 – 26 2fa can't be activated on app.pullrequest.com #2463069 Informative Misconfiguration and Insecure Design None 2024-07-11 – 25 Stored Cross-Site Scripting vulnerability in example Custom Digital Agreement #983077 Valid Cross-site Scripting Medium 2021-03-18 – 25 Unicorn worker pool exhaustion by continuously updating payout preferences #317543 Valid Denial of Service Medium 2018-03-30 – 25 Information Disclosure when /invitations/<token>.json is not yet accepted #290930 Valid Information Disclosure Medium 2019-12-06 – 25 resolved bugs in a program are public despite the program settings #270993 Valid Information Disclosure Low 2017-10-13 – 25 Lack of input sanitization in Marketo form leads to execution of HTML in lead emails #220009 Valid Server-Side Request Forgery – 2017-10-03 $500 25 Disabled account can still use GraphQL endpoint #608656 Valid Access Control Low 2020-03-12 – 24 report id is exposed for undisclosed reports in Hacktivity #493484 Informative Information Disclosure Low 2019-02-16 – 24