Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer #2263294 Informative Input Validation and Logic None 2024-05-10 – 91 [hackerone.com] Program's old handles are not blacklisted like usernames and allows reclaim over past handles for potential abuse #2241266 Informative Misconfiguration and Insecure Design Medium 2024-05-30 – 81 Private data related to program exposed via /reports/<id>.json endpoint to external user participant #2580982 Informative Information Disclosure Medium 2024-08-30 – 68 Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery #2501984 Informative Authentication Critical 2024-07-11 – 67 LLM03: Training Data Poisoning via ASCII decoding #2370955 Informative Injection and Smuggling None 2024-05-28 – 61 Bypass comment restriction #2679108 Informative Access Control Medium 2024-09-19 – 48 Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation #2719622 Informative No weakness recorded Medium 2024-09-19 – 33 Reports submitted by a non 2fa setupped user account can be transferred to a 2fa require submission program #2569993 Informative Access Control Low 2024-07-11 – 32 Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation #981036 Informative Input Validation and Logic Low 2021-09-20 – 29 2FA Bypass via Leaked Cookies #2479622 Informative Authentication Medium 2024-07-11 – 28 Session Not Expire / 2FA Bypass #2469706 Informative Authentication Medium 2024-07-11 – 28 2fa can't be activated on app.pullrequest.com #2463069 Informative Misconfiguration and Insecure Design None 2024-07-11 – 25 report id is exposed for undisclosed reports in Hacktivity #493484 Informative Information Disclosure Low 2019-02-16 – 24 Hackerone Email Addresses Enumeration #2429 Informative Information Disclosure – 2016-06-17 – 24 HackerOne is still prone to Internet Explorer UXSS #108056 Informative Cross-Site Request Forgery – 2017-04-19 – 23 Login page password-guessing attack #110 Informative No weakness recorded – 2014-01-16 – 23 2FA requirement bypass when claiming bounty #2528919 Informative Input Validation and Logic – 2024-07-11 – 22 Enumeration of users #761 Informative Misconfiguration and Insecure Design – 2014-10-03 – 20 TOTP Authenticator implementation Accepts Expired Codes #2588810 Informative Authentication High 2024-07-11 – 19 Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled #357576 Informative Information Disclosure None 2018-06-07 – 18 Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token. #1161141 Informative Information Disclosure Critical 2021-04-30 – 16 Enumerating HackerOne Pentests #1139541 Informative Misconfiguration and Insecure Design Low 2021-08-25 – 16 Hackers can reveal the names of private programs that have an external link #1127455 Informative Information Disclosure Low 2021-08-24 – 16 Submitted reports state logs leakage #306733 Informative Information Disclosure Medium 2018-01-19 – 16 Account takeover #17512 Informative Authentication – 2014-07-17 – 16 Manipulate report timeline activity by using null byte. #133322 Informative Misconfiguration and Insecure Design – 2016-07-01 – 12 Unauthorized Team members viewing #123572 Informative Authentication – 2016-07-02 – 12 While adding a payment method - Notification email not sent to newly added email ID as well as there is no verification for new email id (Paypal) #307424 Informative Misconfiguration and Insecure Design Low 2018-01-23 – 10 Missing Password Confirmation at a Critical Function (Payout Method) #303299 Informative Misconfiguration and Insecure Design Medium 2018-01-10 – 10 Reward Money Leakage #149435 Informative Information Disclosure – 2016-08-09 – 10 Session Hijacking attack (Different Scenario) #19640 Informative Authentication – 2014-07-17 – 10 "early preview" programs disclosure #29185 Informative Information Disclosure – 2015-01-21 – 9 Leakage badges on disabled user #325594 Informative Information Disclosure Low 2018-03-15 – 8 Information leakage - Private reports cached by Google #80118 Informative Information Disclosure – 2018-07-23 – 8 Email changing #18846 Informative No weakness recorded – 2014-08-28 – 8 Adding an user email address to the list before confirming. #3923 Informative Misconfiguration and Insecure Design – 2014-06-11 – 8 Ajouter le même utilisateur que celui déjà inscrit dans les équipes #378209 Informative No weakness recorded – 2018-07-17 – 7 Open redirect deceive in hackerone.com via another open redirect link. #296706 Informative Open Redirect Low 2017-12-13 – 7 Partial disclosure of undisclosed programs through <meta> tags #302620 Informative Information Disclosure – 2018-01-11 – 6 Logical Issue (Boosting Reputation points) #60429 Informative No weakness recorded – 2015-07-21 – 6 Flooding mailbox of user #10109 Informative Misconfiguration and Insecure Design – 2014-04-30 – 6 harvesting attack on user registration #2193 Informative No weakness recorded – 2014-05-19 – 6 Information Disclosure which violate program privacy #313075 Informative Information Disclosure Low 2018-02-20 – 5 Possible XSS #123278 Informative Cross-site Scripting – 2016-04-21 – 5 Substantially weakened authenticity verification when using 'Remember me for a week' #49357 Informative Cryptography – 2015-03-12 – 5 No option to logout concurrent sessions #20122 Informative No weakness recorded – 2014-07-17 – 5 Issue with password change in Disabled Account #279914 Informative Misconfiguration and Insecure Design Low 2017-11-16 – 4 HackerOne Private Programs users disclosure and de-anonymous-ize #92716 Informative Information Disclosure – 2015-12-08 – 4 Account Hijacking (Only rare case scenario) #21083 Informative Authentication – 2014-08-23 – 4 Arbitrary file uploads to Amazon WS. #7929 Informative Misconfiguration and Insecure Design – 2014-04-26 – 4