How the Bug stole hacking Analysed #762510 Valid Insecure Direct Object Reference None 2019-12-20 – 471 HackerOne making payments in USDC (Coinbase stable coin) Analysed #1220747 Valid No weakness recorded None 2021-06-17 – 201 Private program disclosure via `vpn_suspended` GraphQL query Analysed #715192 Valid Information Disclosure None 2019-10-21 $2,500 138 How the Arch Angel stole Live Events Analysed #2285198 Valid No weakness recorded None 2023-12-15 – 98 Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com) Analysed #995995 Valid Cross-site Scripting None 2020-11-09 – 84 Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?) Analysed #170310 Valid Misconfiguration and Insecure Design None 2016-12-08 – 76 Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeover Analysed #514451 Valid Server-Side Request Forgery None 2019-04-04 $500 68 HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms Analysed #298265 Valid No weakness recorded None 2018-03-13 – 65 HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information Analysed #378122 Valid Information Disclosure None 2018-07-26 – 60 Stored XSS on https://events.hackerone.com Analysed #1028332 Valid Cross-site Scripting None 2021-03-26 – 59 Register & create a ticket as somebody else on HackerOne Support Analysed #2082680 Valid Misconfiguration and Insecure Design None 2023-07-31 – 56 Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io Analysed #1028345 Valid Open Redirect None 2021-03-26 – 54 Open Redirection in index.php page Analysed #320376 Valid Open Redirect None 2018-03-07 – 53 Open redirect vulnerability in index.php Analysed #439075 Valid Open Redirect None 2019-02-03 – 39 Team object in GraphQL that have a published external program may expose existence of a private program Analysed #347937 Valid Information Disclosure None 2018-07-04 – 39 Updating payout preference to CurrencyCloud doesn't notify user via email Analysed #240083 Valid Misconfiguration and Insecure Design None 2018-01-31 $500 35 Open Redirection in [https://www.hackerone.com/index.php] Analysed #562417 Valid Open Redirect None 2019-05-08 – 33 Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml #1028396 Valid Cross-site Scripting None 2021-03-26 – 32 Program profile_metrics.json contains time to triage for deptofdefense even it's turned off Analysed #318399 Valid Information Disclosure None 2018-03-09 $250 27 User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program Analysed #350964 Valid Information Disclosure None 2018-06-27 – 24 Used email confirmation link reveals the email address which is tied to it Analysed #1128358 Valid Information Disclosure None 2021-09-22 – 21 Invalid Phabricator API token revealed through error message when escalating a report Analysed #335123 Valid Information Disclosure None 2018-06-27 $500 18 Lack of length validation on user address attribute Analysed #161947 Valid Denial of Service None 2019-04-11 – 18 Missing Certificate Authority Authorization rule Analysed #410245 Valid Cryptography None 2019-04-11 – 17 Private partial disclosure of h1 infrastructure Analysed #283361 Valid Information Disclosure None 2017-11-03 – 17 www.hackerone.com website CSP "script-src" includes "unsafe-inline" Analysed #225833 Valid Misconfiguration and Insecure Design None 2017-05-23 – 17 GitHub users outside of HackerOne organization can create and update Wiki pages of certain public HackerOne repositories #459634 Valid Input Validation and Logic None 2018-12-12 – 12 Verbose PHP error messages exposed on a blog article #439174 Valid Information Disclosure None 2019-04-10 – 11 Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page #280770 Valid Information Disclosure None 2017-11-01 – 9 CSV injection in the credentials export #1131887 Valid Misconfiguration and Insecure Design None 2021-09-22 – 6