Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Full read SSRF in www.evernote.com that can leak aws metadata and local file inclusionAnalysed#1189367	Valid	Server-Side Request Forgery	–	2021-12-06	–	264
Wormable stored XSS in www.evernote.com#397968	Valid	No weakness recorded	–	2018-08-21	–	62
CSRF leads to account deactivation of users#1121990	Valid	No weakness recorded	–	2021-10-19	$300	44
2 click Remote Code execution in Evernote Android#1377748	Valid	File and Path Handling	–	2022-03-29	–	30
Non-production Open Database In Combination With XXE Leads To SSRF#742808	Not checked yet	Injection and Smuggling	–	–	–	25
[34.96.80.155] Server Logs Disclosure lead to Information Leakage#1398270	Valid	Access Control	–	2021-12-09	$150	23
Email Verification Bypass by bruteforcing when setting up 2FA#1394984	Valid	Authentication	–	2022-05-22	$150	23
One Click Code Execution via File#822609	Not checked yet	Access Control	–	–	–	23
Reflected XSS in the shared note view on https://evernote.com#1518343	Valid	Cross-site Scripting	–	2022-04-20	$500	18

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.