Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
16 of 15,219 reports · 227 analysed so far
- #732987ValidReflected XSSOWOX, Inc. · Cross-site Scripting · 2019–20votes
- #291012ValidServer-side cache poisoning leads to the http://my.dev.owox.com inaccessibilityOWOX, Inc. · No weakness recorded · 2017–18votes
- #709378ValidSession is not expire after logoutOWOX, Inc. · Authentication · 2019–17votes
- #222082ValidBroken Authentication & Session Management (Login Bypass) at support.owox.comOWOX, Inc. · Authentication · 2017–17votes
- #192922ValidStored XSS at https://finance.owox.com/customer/accountListOWOX, Inc. · Cross-site Scripting · 2017–16votes
- #925513ValidUnrestricted File Upload in Chat WindowOWOX, Inc. · Misconfiguration and Insecure Design · 2020–13votes
- #171473ValidHTTP Response Splitting(CRLF injection) in bi.owox.comOWOX, Inc. · Command and Code Injection · 2016–13votes
- #186586ValidAccess to Grafana DashboardOWOX, Inc. · Information Disclosure · 2017–12votes
- #182576ValidSubdomain Takeover on http://kiosk.owox.com/OWOX, Inc. · Authentication · 2016–12votes
- #205949ValidSubdomain takeover in many subdomainsOWOX, Inc. · Access Control · 2017–9votes
- #733051ValidThe URL in "Choose a data source'' at "https://bi.owox.com/ui/settings/connected-services/setup/" is not filtered => reflected XSS.OWOX, Inc. · Cross-site Scripting · 2019–8votes
- #183318N/ADirect IP AccessOWOX, Inc. · Information Disclosure · 2017–4votes
- #186393DuplicateSubdomain Takeover on OWOX.RUOWOX, Inc. · Authentication · 2017–2votes
- #184884InformativeSubdomain Takeover on http://blog.owox.com/OWOX, Inc. · Authentication · 2017–2votes
- #184881N/Ainvalid URL parsing with and '@'OWOX, Inc. · Injection and Smuggling · 2017–2votes
- #183127DuplicateClickJackingOWOX, Inc. · Misconfiguration and Insecure Design · 2017–1votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.