Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
8 of 15,219 reports · 227 analysed so far
- #688270ValidOS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475)Central Security Project · Command and Code Injection · 2019–34votes
- #654888ValidOS Command Injection in Nexus Repository Manager 2.xCentral Security Project · Command and Code Injection · 2019–28votes
- #683965ValidUnrestricted File Upload Leading to Remote Code ExecutionCentral Security Project · Input Validation and Logic · 2019–12votes
- #724599ValidOS Command Injection in Nexus Repository Manager 2.x -- Bypass for Nexus Repository Manage 2.14.15-01 Command Injection fixCentral Security Project · Command and Code Injection · 2020–7votes
- #917843ValidUnsafe deserialization in Nexus Repository helm pluginCentral Security Project · Deserialization and Object Injection · 2020–5votes
- #509315Validc3p0 may be exploited by a Billion Laughs Attack when loading XML configurationCentral Security Project · Other weaknesses · 2019–5votes
- #879740ValidRepositories of datanucleus are fetched over insecure protocol (http insted of https)Central Security Project · Cryptography · 2020–1votes
- #506791InformativePippo XML Entity Expansion (Billion Laughs Attack)Central Security Project · Other weaknesses · 2019–1votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.