Partial disclosure of report activity through new "Export as .zip" feature Analysed #182358 Valid Information Disclosure High 2016-11-29 $10,000 355 Internal attachments can be exported via "Export as .zip" feature Analysed #186230 Valid Information Disclosure High 2016-11-30 $12,500 269 Web Authentication Endpoint Credentials Brute-Force Vulnerability Analysed #127844 Valid Authentication – 2016-06-23 – 161 Hacker.One Subdomain Takeover Analysed #159156 Valid Misconfiguration and Insecure Design Low 2016-09-20 – 154 Race Conditions in Popular reports feature. Analysed #146845 Valid Memory Corruption – 2016-08-03 – 125 Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?) Analysed #170310 Valid Misconfiguration and Insecure Design None 2016-12-08 – 76 (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation Analysed #171398 Valid Cross-site Scripting Low 2016-10-27 – 44 AWS S3 bucket writeable for authenticated aws users Analysed #128088 Valid Authentication – 2016-04-05 – 42 Information leakage of private program Analysed #159526 Valid Information Disclosure – 2016-08-18 $500 35 RCE in profile picture upload Analysed #135072 Valid Command and Code Injection – 2016-06-08 – 32 Non-secure requests are not automatically upgraded to HTTPS Analysed #158186 Valid No weakness recorded – 2016-08-19 – 30 Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session Analysed #111968 Valid Open Redirect – 2016-02-24 – 28 Ability to enumerate private programs using SAML Analysed #167828 Valid Information Disclosure – 2016-09-14 – 24 Know undisclosed Bounty Amount when Bounty Statistics are enabled. Analysed #148050 Valid Information Disclosure – 2016-09-02 – 23 HTML injection can lead to data theft Analysed #110578 Valid Misconfiguration and Insecure Design – 2016-01-26 $500 21 Possible CSRF during joining report as participant Analysed #148517 Valid Cross-Site Request Forgery – 2016-07-12 – 18 Unintended HTML inclusion as a result of https://hackerone.com/reports/110578 Analysed #112935 Valid No weakness recorded – 2016-02-24 – 18 Know whether private program for company exist or not Analysed #105887 Valid Information Disclosure – 2016-01-15 – 18 Users contents on AWS is cacheable Analysed #163131 Valid Information Disclosure – 2016-09-06 – 16 Old titles are not hidden in reports with limited disclosure Analysed #144129 Valid Information Disclosure – 2016-06-21 – 16 Researcher gets email updates on a private program after he/she quits that program. Analysed #174449 Valid Information Disclosure Low 2016-11-21 – 15 Able to remove the admin access of my program Analysed #141629 Valid Misconfiguration and Insecure Design – 2016-07-06 – 15 Inadequate access controls in "Vote" functionality??? Analysed #137503 Valid Access Control – 2016-05-12 – 15 Obtain the username & the uid of the one doing the S3 sync on Hackerone #173175 Valid Information Disclosure – 2016-10-03 – 14 Race Conditions Exist When Accepting Invitations #119354 Valid Misconfiguration and Insecure Design – 2016-04-26 – 14 Requesting Mediation possible on reports that are too old for mediation #159512 Valid Access Control – 2016-08-17 – 13 Possible CSRF during external programs #174470 Valid Cross-Site Request Forgery Low 2016-10-18 – 12 Improve signals in reputation #106305 Valid Misconfiguration and Insecure Design – 2016-01-07 – 12 All Active user sessions should be deleted when user change his password! #9950 Valid Misconfiguration and Insecure Design – 2016-04-25 $100 11 New hacktivity view discloses report IDs of non-public reports #127620 Valid Misconfiguration and Insecure Design – 2016-04-05 $500 10 CSV Injection via the CSV export feature #111192 Valid Command and Code Injection – 2016-02-16 – 10 Reflected File Download #39658 Valid Misconfiguration and Insecure Design – 2016-04-25 – 10 LinkedIN URL should be HTTPS #1093 Valid No weakness recorded – 2016-05-18 – 10 Information disclosure via policy update notifications after removal from program #177484 Valid Information Disclosure Low 2016-10-29 – 9 Disclosure of external users invited to a specific report #157699 Valid Information Disclosure – 2016-09-01 – 9 Private program activity timeline information disclosure #116029 Valid Authentication – 2016-03-16 – 9 Reflected Filename Download #54034 Valid Command and Code Injection – 2016-04-25 – 9 External programs revealing info #124929 Valid Authentication – 2016-04-01 $1,500 8 External links should use rel="noopener" or use the redirect service #124620 Valid Open Redirect – 2016-04-05 – 8 Increase number of bugs by sending duplicate of your own valid report #116951 Valid Misconfiguration and Insecure Design – 2016-04-25 – 8 Deleted name still present via mouseover functionality for user accounts #127914 Valid Information Disclosure – 2016-04-21 – 7 Null byte injection #116189 Valid No weakness recorded – 2016-02-23 – 7 Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants #107336 Valid Access Control – 2016-01-27 – 7 Accepting Invalid characters on email address #3991 Valid Misconfiguration and Insecure Design – 2016-04-25 – 7 DOS Report FILE html inside <code> in markdown #127827 Valid Denial of Service – 2016-05-21 – 6 New hacktivity view discloses report IDs of non-public reports #127235 Valid No weakness recorded – 2016-04-26 – 6 Websites opened from reports can change url of report page #124889 Valid Cross-Site Request Forgery – 2016-04-21 – 6 Denial of Service any Report #118663 Valid Denial of Service – 2016-03-09 – 6 Private Program Disclosure in /:handle/reports/draft.json endpoint #116032 Valid Authentication – 2016-02-16 – 6 Multiple issues with Markdown and URL parsing #113070 Valid Misconfiguration and Insecure Design – 2016-04-21 $500 6