Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
44 of 15,219 reports · 161 analysed so far
- #651518ValidOS Command Injection via egrep in Rake::FileListRuby · Command and Code Injection · 2019–62votes
- #1131465ValidPath traversal in Tempfile on windows OS due to unsanitized backslashesRuby · File and Path Handling · 2021–54votes
- #965267ValidPotential HTTP Request Smuggling in ruby webrickRuby · Injection and Smuggling · 2020–53votes
- #1187477ValidRCE by parsing `.rdoc_options` in RDocRuby · Command and Code Injection · 2024–41votes
- #449482ValidCommand injection in PathnameRuby · Command and Code Injection · 2019–36votes
- #1485717ValidReDoS in IPAddrRuby · No weakness recorded · 2025–32votes
- #294462ValidNET::Ftp allows command injection in filenamesRuby · Command and Code Injection · 2017–28votes
- #1487889ValidReDoS in PsychRuby · No weakness recorded · 2025–26votes
- #499ValidRuby: Heap Overflow in Floating Point ParsingRuby · No weakness recorded · 2013–26votes
- #1444501ValidURI parser's RFC3986 regular expression has poor performance when there are two # characters, leading to ReDoSRuby · No weakness recorded · 2023–22votes
- #2666849ValidUncontrolled Resource Consumption when parsing maliciously crafted XML with REXMLRuby · Denial of Service · 2025 · Medium–21votes
- #1104077ValidRound-trip instability in REXMLRuby · No weakness recorded · 2021–20votes
- #706934ValidVariant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON)Ruby · Input Validation and Logic · 2020–20votes
- #212241Validsprintf combined format string attackRuby · Memory Corruption · 2017–18votes
- #661722ValidWEBrick::HTTPAuth::DigestAuth authentication is vulnerable to regular expression denial of service (ReDoS)Ruby · Denial of Service · 2019–17votes
- #302997ValidUnix domain socket and a path containing a null characterRuby · Access Control · 2018–17votes
- #170548ValidRuby OpenSSL Library - IV Reuse in GCM ModeRuby · No weakness recorded · 2021–17votes
- #166661ValidArbitrary heap overread in strscan on 32 bit Ruby, patch includedRuby · Information Disclosure · 2016–17votes
- #302298ValidUnintentional file creation caused at Tempfile with directory traversalRuby · Access Control · 2018–15votes
- #209223ValidOpen S3 Bucket WriteAble To Any Aws UserRuby · Authentication · 2017–14votes
- #207053ValidWritable RubyCi Amazon s3 bucketRuby · Authentication · 2017–14votes
- #302338ValidThe possibility that unintended file operation may be performed because some methods of `Dir` do not check NULL characters.Ruby · Access Control · 2018–13votes
- #144482ValidStringIO strio_getline() can divulge arbitrary memoryRuby · Memory Corruption · 2016–13votes
- #298246Validcontrolled buffer under-read in pack_unpack_internal()Ruby · Memory Corruption · 2018–12votes
- #387250ValidOpenSSL::X509::Name Equality Check Does Not Work, Patch includedRuby · Cryptography · 2018–11votes
- #1178562Validimap: StartTLS stripping attack (CVE-2016-0772).Ruby · Cryptography · 2021–10votes
- #137631ValidSMTP command injectionRuby · Command and Code Injection · 2016–10votes
- #1145454Validlib/net/ftp.rb: trusting PASV responses allow client abuseRuby · Information Disclosure · 2021–9votes
- #209949ValidArbitrary heap exposure in JSON.generateRuby · Memory Corruption · 2017–9votes
- #1204695ValidRubyのCGIライブラリにHTTPレスポンス分割（HTTPヘッダインジェクション）があり、秘密情報が漏洩するRuby · Injection and Smuggling · 2022–8votes
- #745921ValidCode Injection Bug ReportRuby · Command and Code Injection · 2021–8votes
- #519061ValidRuby is shipping a vulnerable jQueryRuby · No weakness recorded · 2019–8votes
- #1161691ValidOS Command Injection in 'rdoc' documentation generatorRuby · Command and Code Injection · 2021–7votes
- #209251Validpublic report - Reproducible - Writable RubyCi Amazon s3 bucket[207053]Ruby · Authentication · 2017–7votes
- #192127ValidBuffer underflow in sprintfRuby · Memory Corruption · 2017–7votes
- #1204977ValidCGI::Cookieクラスにおけるセキュリティ上好ましくない仕様および実装Ruby · Injection and Smuggling · 2022–6votes
- #1485501ValidReDoS in Time.rfc2822Ruby · No weakness recorded · 2023–5votes
- #223363ValidEscape sequence injection vulnerability in WEBrick BasicAuthRuby · Command and Code Injection · 2017–5votes
- #198927ValidParsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfaultRuby · Memory Corruption · 2017–4votes
- #153794ValidResponse splitting vulnerability in WEBrickRuby · Cross-site Scripting · 2018–4votes
- #449617ValidNull character at fnmatchRuby · No weakness recorded · 2019–3votes
- #235842ValidRuby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAMLRuby · Memory Corruption · 2017–3votes
- #331984ValidHTTP header can split /[\r\n]/ instead of /\r\n/Ruby · No weakness recorded · 2019–1votes
- #327512ValidPotential command injection in `Shell#[]` and `Shell#test`Ruby · Command and Code Injection · 2019–1votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.