Skip to content
Sign in

Bug bounty reports15,219

Atlas

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Program:Elastic
Status
Severity
Weakness
Year
Bounty paid2
Access stated
  • No account0
  • A user account0
  • Admin or privileged0
Access needed
  • No account0
  • A user account0
  • A privileged role0
  • Admin0
  • Physical or local access0
  • Not clear from the report0
Clear filters14 of 15,219 reports
Disclosed bug bounty reports
ReportStatusWeaknessSeverityDisclosedBountyVotes
Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)#998398ValidCross-site Scripting–2021-08-16–157
CVE-2021-40870 on [52.204.160.31]#1356845ValidCommand and Code Injection–2021-10-06–75
Critical || Unrestricted access to private Github repos and properties of Elastic through leaked token of Elastic employee#1266188ValidCryptography–2021-09-01–64
blind Server-Side Request Forgery (SSRF) allows scanning internal ports#1300585ValidServer-Side Request Forgery–2023-05-05–54
Synthetics Recorder: Code injection when recording website with malicious content#1636382ValidCommand and Code Injection–2023-04-08–47
CSRF in AppSearch allows creation of "curations"#1477050ValidCross-Site Request Forgery–2022-11-17–35
RCE hazard in reporting (via Chromium)#1168765ValidAccess Control–2021-05-26$10,00025
Improper authorization on `/api/as/v1/credentials/` for Dev Role User with Limited Engine Access#1218680ValidAccess Control–2021-08-03–21
Remote Code Execution in coming Kibana 7.7.0#861744ValidAccess Control–2021-04-19$5,00014
Default password on 34.120.209.175#1415241ValidAuthentication–2022-11-18–13
Improper authorization on `/api/as/v1/credentials/` allows any App Search user to access all API keys and escalate privileges#1168528ValidAccess Control–2021-06-02–13
Fix for CVE-2021-22151 (Kibana path traversal issue) can be bypassed on Windows#1353603ValidFile and Path Handling–2021-11-15–10
XXE in Enterprise Search's App Search web crawler#1156748ValidInjection and Smuggling–2021-04-29–9
[Swiftype] - Stored XSS via document field `url` triggers on `https://app.swiftype.com/engines/<engine>/document_types/<type>/documents/<id>`#1245787ValidCross-site Scripting–2021-08-03–7

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in