HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com #97292 Valid No weakness recorded – 2015-12-02 – 18 PNG compression DoS #454 Valid Denial of Service – 2015-05-28 $500 18 Missing Certificate Authority Authorization rule #410245 Valid Cryptography None 2019-04-11 – 17 Private partial disclosure of h1 infrastructure #283361 Valid Information Disclosure None 2017-11-03 – 17 www.hackerone.com website CSP "script-src" includes "unsafe-inline" #225833 Valid Misconfiguration and Insecure Design None 2017-05-23 – 17 Example HackerOne security@ forward domain is not registered #218705 Valid Misconfiguration and Insecure Design – 2017-04-10 – 17 Previous attachments can be referenced when creating a new report #129773 Valid Misconfiguration and Insecure Design Low 2019-04-12 – 17 Homograph attack #59375 Valid Misconfiguration and Insecure Design – 2015-05-09 – 17 File Name Enumeration #33935 Valid Information Disclosure – 2014-11-17 – 17 PII data Leakage through hackerone reports #1256371 Valid Information Disclosure Low 2021-08-09 – 16 Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token. #1161141 Informative Information Disclosure Critical 2021-04-30 – 16 Enumerating HackerOne Pentests #1139541 Informative Misconfiguration and Insecure Design Low 2021-08-25 – 16 Hackers can reveal the names of private programs that have an external link #1127455 Informative Information Disclosure Low 2021-08-24 – 16 Invited team member can disclosure slack channels #509574 Valid Information Disclosure Low 2019-04-05 $500 16 Submitted reports state logs leakage #306733 Informative Information Disclosure Medium 2018-01-19 – 16 Users contents on AWS is cacheable #163131 Valid Information Disclosure – 2016-09-06 – 16 Ability to monitor reports' submission in real time #159890 N/A Access Control – 2016-08-17 – 16 Old titles are not hidden in reports with limited disclosure #144129 Valid Information Disclosure – 2016-06-21 – 16 Markdown parsing issue enables insertion of malicious tags and event handlers #46916 Valid Cross-site Scripting – 2015-04-07 $5,000 16 Account takeover #17512 Informative Authentication – 2014-07-17 – 16 Password Reset Bug #8082 Valid Misconfiguration and Insecure Design – 2014-09-25 $100 16 Flawed account creation process allows registration of usernames corresponding to existing file names #275 Valid No weakness recorded – 2015-06-08 – 16 Changes to data in a CVE request after draft via GraphQL query #813300 Valid Other weaknesses Low 2020-05-15 – 15 Moving a report to a different program doesn't reassign the Custom Field Values #511779 Valid Insecure Direct Object Reference Low 2019-04-25 – 15 Lack of cross-origin request blocking allows leaking of sensitive information on several endpoints #350739 Duplicate Information Disclosure – 2018-06-07 – 15 Researcher gets email updates on a private program after he/she quits that program. #174449 Valid Information Disclosure Low 2016-11-21 – 15 Able to remove the admin access of my program #141629 Valid Misconfiguration and Insecure Design – 2016-07-06 – 15 Inadequate access controls in "Vote" functionality??? #137503 Valid Access Control – 2016-05-12 – 15 CSV Injection at the CSV export feature #118582 Valid Command and Code Injection Low 2019-04-08 – 15 Report title and issue information prepopulated #111868 N/A No weakness recorded – 2016-07-15 – 15 Pre-generation of 2FA secret/backup codes seems like an unnecessary risk #100509 Valid No weakness recorded – 2015-12-02 $1,000 15 Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met) #17383 Valid Authentication – 2014-07-26 – 15 Session not invalidated after password reset #15785 Valid Misconfiguration and Insecure Design – 2014-06-10 – 15 Logical issues with account settings #546 Valid Misconfiguration and Insecure Design – 2015-05-28 – 15 Bypassing the External Link Warning #1139520 Valid Open Redirect Low 2021-05-07 – 14 Obtain the username & the uid of the one doing the S3 sync on Hackerone #173175 Valid Information Disclosure – 2016-10-03 – 14 Missing rate limit on critical user actions e.g. reset password, change email, disable account. #157750 Valid Access Control – 2019-04-11 – 14 Race Conditions Exist When Accepting Invitations #119354 Valid Misconfiguration and Insecure Design – 2016-04-26 – 14 Gain reputation by creating a duplicate of an existing report #35237 Valid Misconfiguration and Insecure Design – 2015-08-14 – 14 Control Characters Not Stripped From Username on Signup #3227 Valid Misconfiguration and Insecure Design – 2014-03-11 – 14 Session Management #288 Valid No weakness recorded – 2014-04-19 – 14 Hackers can Invite Collaborators Without 2FA on Programs Requiring 2FA #2575079 Duplicate No weakness recorded Medium 2024-07-11 – 13 Requesting Mediation possible on reports that are too old for mediation #159512 Valid Access Control – 2016-08-17 – 13 CSV Injection with the CVS export feature #72785 Valid Command and Code Injection – 2015-09-21 – 13 CSS leaks SCSS debug info #2221 Valid Information Disclosure – 2014-02-28 – 13 Temporary banned user (from platform) is able to make submissions via embedded submission forms #1133536 Valid Input Validation and Logic Low 2021-09-22 – 12 GitHub users outside of HackerOne organization can create and update Wiki pages of certain public HackerOne repositories #459634 Valid Input Validation and Logic None 2018-12-12 – 12 javascript: and mailto: links are allowed in JIRA integration settings #209917 Duplicate Misconfiguration and Insecure Design Low 2017-04-10 – 12 Possible CSRF during external programs #174470 Valid Cross-Site Request Forgery Low 2016-10-18 – 12 Manipulate report timeline activity by using null byte. #133322 Informative Misconfiguration and Insecure Design – 2016-07-01 – 12