Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAny class
- Any class
- Cross-site Scripting4
- Open Redirect2
- Command and Code Injection11
- Injection and Smuggling5
- Deserialization and Object Injection1
- File and Path Handling2
- Memory Corruption11
- Denial of Service6
- Input Validation and Logic1
- Misconfiguration and Insecure Design1
- Cryptography3
- Information Disclosure4
- Authentication3
- Access Control3
- No weakness recorded16
73 of 15,219 reports · 161 analysed so far
- #651518ValidOS Command Injection via egrep in Rake::FileListRuby · Command and Code Injection · 2019–62votes
- #1131465ValidPath traversal in Tempfile on windows OS due to unsanitized backslashesRuby · File and Path Handling · 2021–54votes
- #965267ValidPotential HTTP Request Smuggling in ruby webrickRuby · Injection and Smuggling · 2020–53votes
- #1187477ValidRCE by parsing `.rdoc_options` in RDocRuby · Command and Code Injection · 2024–41votes
- #459084InformativeThe taint flag is not propagated at JSON.parseRuby · No weakness recorded · 2024–40votes
- #449482ValidCommand injection in PathnameRuby · Command and Code Injection · 2019–36votes
- #1485717ValidReDoS in IPAddrRuby · No weakness recorded · 2025–32votes
- #294462ValidNET::Ftp allows command injection in filenamesRuby · Command and Code Injection · 2017–28votes
- #1487889ValidReDoS in PsychRuby · No weakness recorded · 2025–26votes
- #499ValidRuby: Heap Overflow in Floating Point ParsingRuby · No weakness recorded · 2013–26votes
- #1444501ValidURI parser's RFC3986 regular expression has poor performance when there are two # characters, leading to ReDoSRuby · No weakness recorded · 2023–22votes
- #2666849ValidUncontrolled Resource Consumption when parsing maliciously crafted XML with REXMLRuby · Denial of Service · 2025 · Medium–21votes
- #1104077ValidRound-trip instability in REXMLRuby · No weakness recorded · 2021–20votes
- #706934ValidVariant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON)Ruby · Input Validation and Logic · 2020–20votes
- #212241Validsprintf combined format string attackRuby · Memory Corruption · 2017–18votes
- #661722ValidWEBrick::HTTPAuth::DigestAuth authentication is vulnerable to regular expression denial of service (ReDoS)Ruby · Denial of Service · 2019–17votes
- #302997ValidUnix domain socket and a path containing a null characterRuby · Access Control · 2018–17votes
- #170548ValidRuby OpenSSL Library - IV Reuse in GCM ModeRuby · No weakness recorded · 2021–17votes
- #166661ValidArbitrary heap overread in strscan on 32 bit Ruby, patch includedRuby · Information Disclosure · 2016–17votes
- #1977168InformativeXSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256)Ruby · Cross-site Scripting · 2023–16votes
- #302298ValidUnintentional file creation caused at Tempfile with directory traversalRuby · Access Control · 2018–15votes
- #2271054InformativeDoS in bigdecimal's sqrt function due to miscalculation of loop iterationsRuby · Denial of Service · 2023–14votes
- #209223ValidOpen S3 Bucket WriteAble To Any Aws UserRuby · Authentication · 2017–14votes
- #207053ValidWritable RubyCi Amazon s3 bucketRuby · Authentication · 2017–14votes
- #302338ValidThe possibility that unintended file operation may be performed because some methods of `Dir` do not check NULL characters.Ruby · Access Control · 2018–13votes
- #281942SpamBugsRuby · No weakness recorded · 2017–13votes
- #144482ValidStringIO strio_getline() can divulge arbitrary memoryRuby · Memory Corruption · 2016–13votes
- #298246Validcontrolled buffer under-read in pack_unpack_internal()Ruby · Memory Corruption · 2018–12votes
- #282588SpamTake back my all data from limfuimay@gmail.comRuby · No weakness recorded · 2017–12votes
- #387250ValidOpenSSL::X509::Name Equality Check Does Not Work, Patch includedRuby · Cryptography · 2018–11votes
- #1178562Validimap: StartTLS stripping attack (CVE-2016-0772).Ruby · Cryptography · 2021–10votes
- #137631ValidSMTP command injectionRuby · Command and Code Injection · 2016–10votes
- #1168205Informative'net/http': HTTP Header Injection in the set_content_type methodRuby · Injection and Smuggling · 2022–9votes
- #1145454Validlib/net/ftp.rb: trusting PASV responses allow client abuseRuby · Information Disclosure · 2021–9votes
- #218342N/ARCE (Remote Code Execution) Vulnerability on RubyRuby · File and Path Handling · 2017–9votes
- #209949ValidArbitrary heap exposure in JSON.generateRuby · Memory Corruption · 2017–9votes
- #1204695ValidRubyのCGIライブラリにHTTPレスポンス分割（HTTPヘッダインジェクション）があり、秘密情報が漏洩するRuby · Injection and Smuggling · 2022–8votes
- #1165748Informative'net/ftp': Uncontrolled Resource Consumption (Memory/CPU)Ruby · Denial of Service · 2021–8votes
- #745921ValidCode Injection Bug ReportRuby · Command and Code Injection · 2021–8votes
- #519061ValidRuby is shipping a vulnerable jQueryRuby · No weakness recorded · 2019–8votes
- #156615InformativeAttacker can smuggle a malicious domain in a URI object.Ruby · Open Redirect · 2022–8votes
- #1161691ValidOS Command Injection in 'rdoc' documentation generatorRuby · Command and Code Injection · 2021–7votes
- #209251Validpublic report - Reproducible - Writable RubyCi Amazon s3 bucket[207053]Ruby · Authentication · 2017–7votes
- #192127ValidBuffer underflow in sprintfRuby · Memory Corruption · 2017–7votes
- #1204977ValidCGI::Cookieクラスにおけるセキュリティ上好ましくない仕様および実装Ruby · Injection and Smuggling · 2022–6votes
- #1718757InformativeHeader CRLF Injection in Ruby Net::HTTPRuby · Injection and Smuggling · 2023–5votes
- #1485501ValidReDoS in Time.rfc2822Ruby · No weakness recorded · 2023–5votes
- #1321358InformativeXSS exploit of RDoc documentation generated by rdocRuby · Cross-site Scripting · 2023–5votes
- #287835InformativeResolv::getaddresses bug that can be abused to bypass security measures.Ruby · Misconfiguration and Insecure Design · 2018–5votes
- #223363ValidEscape sequence injection vulnerability in WEBrick BasicAuthRuby · Command and Code Injection · 2017–5votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.