Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
NET::Ftp allows command injection in filenames#294462	Valid	Command and Code Injection	–	2017-12-19	–	28
sprintf combined format string attack#212241	Valid	Memory Corruption	–	2017-09-22	–	18
Open S3 Bucket WriteAble To Any Aws User#209223	Valid	Authentication	–	2017-03-29	–	14
Writable RubyCi Amazon s3 bucket#207053	Valid	Authentication	–	2017-02-27	–	14
Bugs#281942	Spam	No weakness recorded	–	2017-12-15	–	13
Take back my all data from limfuimay@gmail.com#282588	Spam	No weakness recorded	–	2017-12-15	–	12
RCE (Remote Code Execution) Vulnerability on Ruby#218342	N/A	File and Path Handling	–	2017-04-05	–	9
Arbitrary heap exposure in JSON.generate#209949	Valid	Memory Corruption	–	2017-09-25	–	9
public report - Reproducible - Writable RubyCi Amazon s3 bucket[207053]#209251	Valid	Authentication	–	2017-03-29	–	7
Buffer underflow in sprintf#192127	Valid	Memory Corruption	–	2017-03-05	–	7
Escape sequence injection vulnerability in WEBrick BasicAuth#223363	Valid	Command and Code Injection	–	2017-09-15	–	5
Ruby:HTTP Header injection in 'net/http'#146416	Informative	Open Redirect	–	2017-02-27	–	5
Ruby 2.4.1 has "Stack consistency error" and aborts when processing return statement within a case statement#247640	Informative	Memory Corruption	–	2017-09-24	–	4
Parsing invalid unicode codepoints using json c extension (2.0.1+) triggers a segfault#198927	Valid	Memory Corruption	–	2017-10-25	–	4
Ruby 2.3.x and 2.2.x still bundle DoS vulnerable verision of libYAML#235842	Valid	Memory Corruption	–	2017-10-25	–	3
Provide a security sistem most fit to our team#281850	N/A	No weakness recorded	–	2017-12-15	–	1
Open aws s3 bucket s3://rubyci#257276	N/A	Information Disclosure	–	2017-08-06	–	1

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.