Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
7 of 15,219 reports · 227 analysed so far
- #651518ValidOS Command Injection via egrep in Rake::FileListRuby · Command and Code Injection · 2019–62votes
- #449482ValidCommand injection in PathnameRuby · Command and Code Injection · 2019–36votes
- #661722ValidWEBrick::HTTPAuth::DigestAuth authentication is vulnerable to regular expression denial of service (ReDoS)Ruby · Denial of Service · 2019–17votes
- #519061ValidRuby is shipping a vulnerable jQueryRuby · No weakness recorded · 2019–8votes
- #449617ValidNull character at fnmatchRuby · No weakness recorded · 2019–3votes
- #331984ValidHTTP header can split /[\r\n]/ instead of /\r\n/Ruby · No weakness recorded · 2019–1votes
- #327512ValidPotential command injection in `Shell#[]` and `Shell#test`Ruby · Command and Code Injection · 2019–1votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.