Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
22 of 15,219 reports · 227 analysed so far
- #459084InformativeThe taint flag is not propagated at JSON.parseRuby · No weakness recorded · 2024–40votes
- #1977168InformativeXSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256)Ruby · Cross-site Scripting · 2023–16votes
- #2271054InformativeDoS in bigdecimal's sqrt function due to miscalculation of loop iterationsRuby · Denial of Service · 2023–14votes
- #1168205Informative'net/http': HTTP Header Injection in the set_content_type methodRuby · Injection and Smuggling · 2022–9votes
- #1165748Informative'net/ftp': Uncontrolled Resource Consumption (Memory/CPU)Ruby · Denial of Service · 2021–8votes
- #156615InformativeAttacker can smuggle a malicious domain in a URI object.Ruby · Open Redirect · 2022–8votes
- #1718757InformativeHeader CRLF Injection in Ruby Net::HTTPRuby · Injection and Smuggling · 2023–5votes
- #1321358InformativeXSS exploit of RDoc documentation generated by rdocRuby · Cross-site Scripting · 2023–5votes
- #287835InformativeResolv::getaddresses bug that can be abused to bypass security measures.Ruby · Misconfiguration and Insecure Design · 2018–5votes
- #146416InformativeRuby:HTTP Header injection in 'net/http'Ruby · Open Redirect · 2017–5votes
- #1977258InformativeStored XSS in RDoc hyperlinks through javascript schemeRuby · Cross-site Scripting · 2023–4votes
- #1158824InformativeOS Command Injection in '/lib/un.rb -- Utilities to replace common UNIX commands in Makefiles etc'Ruby · Command and Code Injection · 2021–4votes
- #247640InformativeRuby 2.4.1 has "Stack consistency error" and aborts when processing return statement within a case statementRuby · Memory Corruption · 2017–4votes
- #1301696InformativeBug Report : [ No Valid SPF Records ]Ruby · No weakness recorded · 2022–3votes
- #1189419InformativeXMLRPC does not limit deserializable classes.Ruby · Deserialization and Object Injection · 2023–3votes
- #980249InformativeNet::SMTP with tls allows forged certificates as long as the hostname matchesRuby · Cryptography · 2021–3votes
- #144485InformativeHeap corruption in string.c tr_trans() due to undersized bufferRuby · Memory Corruption · 2016–2votes
- #898614InformativeDRb denial of service vulnerabilityRuby · Denial of Service · 2021–1votes
- #144484InformativeHeap corruption in DateTime.strftime() on 32 bit for certain format stringsRuby · Memory Corruption · 2016–1votes
- #363934InformativeSEGV in parse_rat()Ruby · Denial of Service · 2018–0votes
- #341634InformativeInvalid URL parsing '#'Ruby · No weakness recorded · 2018–0votes
- #304115InformativeInteger Underflow @ ossl_cipher_pkcs5_keyivgenRuby · Memory Corruption · 2018–0votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.