User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program #350964 Valid Information Disclosure None 2018-06-27 – 24 Transitioning a Private Program to Public Does Not Clear Previously Private Updates to Hackers #210190 Valid Information Disclosure Medium 2017-04-05 $500 24 Ability to enumerate private programs using SAML #167828 Valid Information Disclosure – 2016-09-14 – 24 Hackerone Email Addresses Enumeration #2429 Informative Information Disclosure – 2016-06-17 – 24 Information disclosure (reset password token) and changing the user's password #738 Valid Cross-Site Request Forgery – 2014-02-19 $100 24 Improper session management #737 Valid Authentication – 2014-02-19 $100 24 CSRF login #547 Valid Cross-Site Request Forgery – 2014-01-13 – 24 Mishandling of hackerone clear background checks resulting in disclosure of other hacker's information #1240162 Valid Memory Corruption Medium 2021-08-05 – 23 Tab nabbing in Hackerone inbox. #1145563 Valid Open Redirect Low 2021-08-09 $500 23 Hacker can request mediation for published reports #412988 Valid Access Control Low 2018-11-27 $500 23 Self DOM-Based XSS in www.hackerone.com #406587 Valid Cross-site Scripting Low 2018-11-08 – 23 People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed #353310 Valid Information Disclosure Low 2018-06-25 $500 23 Know undisclosed Bounty Amount when Bounty Statistics are enabled. #148050 Valid Information Disclosure – 2016-09-02 – 23 HackerOne is still prone to Internet Explorer UXSS #108056 Informative Cross-Site Request Forgery – 2017-04-19 – 23 Improperly validated fields allows injection of arbitrary HTML via spoofed React objects #49652 Valid Cross-site Scripting – 2015-03-18 $5,000 23 Login page password-guessing attack #110 Informative No weakness recorded – 2014-01-16 – 23 2FA requirement bypass when claiming bounty #2528919 Informative Input Validation and Logic – 2024-07-11 – 22 program_analytics_benchmarks query shows information not visible in public #826176 Valid Information Disclosure Low 2020-03-27 – 22 Rounding errors on rewarding a bounty leads to bypassing the 20% H1 commission fee #808975 Valid Input Validation and Logic Low 2020-05-15 – 22 Introspection query leaks sensitive graphql system information. #291531 Duplicate Misconfiguration and Insecure Design – 2017-11-22 – 22 Session not expired on logout #353 Valid No weakness recorded – 2014-04-19 $100 22 HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension #1874260 Valid Cross-site Scripting Low 2023-02-14 – 21 Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query #1824342 Valid Information Disclosure Medium 2023-02-22 – 21 Used email confirmation link reveals the email address which is tied to it #1128358 Valid Information Disclosure None 2021-09-22 – 21 Notifications sent due to "Transfer report" functionality may be sent to users who are no longer authorized to see the report #442843 Valid Access Control Low 2018-12-04 $500 21 CRLF injection in info.hacker.one #217058 Valid Injection and Smuggling – 2017-05-03 – 21 Session hijacking attack #163381 N/A No weakness recorded – 2019-12-06 – 21 HTML injection can lead to data theft #110578 Valid Misconfiguration and Insecure Design – 2016-01-26 $500 21 Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered #46072 Valid Cross-site Scripting – 2015-02-03 $5,000 21 Graphql: Sorting the reports by jira_status field resulted to different value #955286 Valid Access Control Low 2020-08-27 – 20 Additional bypass allows SSRF for internal netblocks #288950 Valid Server-Side Request Forgery – 2017-11-16 – 20 Able to create basic user account via Google login on HackerOne Drupal CMS #208407 Valid Authentication – 2017-04-25 – 20 Homograph attack in escalate report #143975 Valid Misconfiguration and Insecure Design Low 2019-04-19 – 20 Missing Certificate Authority Authorization rule #129992 Valid Cryptography – 2017-08-17 – 20 Enumeration of users #761 Informative Misconfiguration and Insecure Design – 2014-10-03 – 20 TOTP Authenticator implementation Accepts Expired Codes #2588810 Informative Authentication High 2024-07-11 – 19 CSRF allows to test email forwarding #1131473 Valid Cross-Site Request Forgery Low 2021-05-13 – 19 Corrupted Authorization header can cause logs not to be ingested properly in ████████ #447488 Valid No weakness recorded Medium 2019-04-04 – 19 Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com #225754 Valid Cryptography – 2017-06-21 – 19 Limited Open redirection using SSO-SAML #178345 Valid Open Redirect Low 2017-03-26 – 19 DNS Misconfiguration #1509 Valid No weakness recorded – 2014-02-15 – 19 Names not completely redacted despite "Redact the names of the involved users" is selected #2122644 Valid Information Disclosure Low 2023-08-29 $500 18 Race condition allows to send multiple times feedback for the hacker #1132171 Valid Race Conditions Low 2021-09-22 – 18 Attacker may be able to bounce enough emails which suspend HackerOne's SES service and cause a DoS of HackerOne's email service #823915 Valid Denial of Service Medium 2020-06-12 – 18 Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled #357576 Informative Information Disclosure None 2018-06-07 – 18 Invalid Phabricator API token revealed through error message when escalating a report #335123 Valid Information Disclosure None 2018-06-27 $500 18 Lack of length validation on user address attribute #161947 Valid Denial of Service None 2019-04-11 – 18 Possible CSRF during joining report as participant #148517 Valid Cross-Site Request Forgery – 2016-07-12 – 18 Unintended HTML inclusion as a result of https://hackerone.com/reports/110578 #112935 Valid No weakness recorded – 2016-02-24 – 18 Know whether private program for company exist or not #105887 Valid Information Disclosure – 2016-01-15 – 18