Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
8 of 15,219 reports · 227 analysed so far
- #259100ValidXSS through `__e2e_action_id` delivered by JSONPQuora · Cross-site Scripting · 2018–53votes
- #189793Valid[Android] XSS via start ContentActivityQuora · Cross-site Scripting · 2017–50votes
- #258460Valid[Quora Android] Possible to steal arbitrary files from mobile deviceQuora · Information Disclosure · 2017–23votes
- #258876ValidXSS when clicking "Share to Twitter" at quora.com/widgets/embed_iframe?path=...Quora · Cross-site Scripting · 2018–21votes
- #189768Valid[controlsyou.quora.com] 429 Too Many Requests Error-Page XSSQuora · Cross-site Scripting · 2017–20votes
- #228539N/Aself xss inQuora · Cross-site Scripting · 2017–7votes
- #266454InformativeIDNs displayed in unicodeQuora · Misconfiguration and Insecure Design · 2017–6votes
- #242489InformativePossibility of DOS Through logging SystemQuora · No weakness recorded · 2017–2votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.