Disclosed bug bounty reports

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Missing SPF for hackerone.com#120	Valid	Misconfiguration and Insecure Design	–	2014-01-09	–	48
Upload profile photo from URL#713	Valid	Server-Side Request Forgery	–	2014-02-15	–	44
DNS Cache Poisoning#487	Valid	No weakness recorded	–	2014-01-09	$100	41
Broken Authentication and session management OWASP A2#284	Valid	Authentication	–	2014-01-09	–	36
Switching the user to the attacker's account#727	Valid	Cross-Site Request Forgery	–	2014-02-20	$150	27
Information disclosure (reset password token) and changing the user's password#738	Valid	Cross-Site Request Forgery	–	2014-02-19	$100	24
Improper session management#737	Valid	Authentication	–	2014-02-19	$100	24
CSRF login#547	Valid	Cross-Site Request Forgery	–	2014-01-13	–	24
Login page password-guessing attack#110	Informative	No weakness recorded	–	2014-01-16	–	23
Session not expired on logout#353	Valid	No weakness recorded	–	2014-04-19	$100	22
Enumeration of users#761	Informative	Misconfiguration and Insecure Design	–	2014-10-03	–	20
DNS Misconfiguration#1509	Valid	No weakness recorded	–	2014-02-15	–	19
File Name Enumeration#33935	Valid	Information Disclosure	–	2014-11-17	–	17
Account takeover#17512	Informative	Authentication	–	2014-07-17	–	16
Password Reset Bug#8082	Valid	Misconfiguration and Insecure Design	–	2014-09-25	$100	16
Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met)#17383	Valid	Authentication	–	2014-07-26	–	15
Session not invalidated after password reset#15785	Valid	Misconfiguration and Insecure Design	–	2014-06-10	–	15
Control Characters Not Stripped From Username on Signup#3227	Valid	Misconfiguration and Insecure Design	–	2014-03-11	–	14
Session Management#288	Valid	No weakness recorded	–	2014-04-19	–	14
CSS leaks SCSS debug info#2221	Valid	Information Disclosure	–	2014-02-28	–	13
homograph attack. IDNs displayed in unicode in bug reports and on external link warning page#29491	Valid	Misconfiguration and Insecure Design	–	2014-10-09	$500	12
No email verification on username change#29331	Valid	Information Disclosure	–	2014-11-17	$500	11
A password reset page does not properly validate the authenticity token at the server side.#742	Valid	Cross-Site Request Forgery	–	2014-04-19	$100	11
Flawed account creation process allows registration of usernames corresponding to existing file names#477	Valid	No weakness recorded	–	2014-04-19	$100	11
Session Hijacking attack (Different Scenario)#19640	Informative	Authentication	–	2014-07-17	–	10
Change Any username and profile link in hackerone#25281	Valid	Access Control	–	2014-09-25	$100	9
Ability to see common response titles of other teams (limited)#31383	Valid	Information Disclosure	–	2014-10-15	–	8
Redirect while opening links in new tabs#23386	Valid	Open Redirect	–	2014-09-12	$500	8
Email changing#18846	Informative	No weakness recorded	–	2014-08-28	–	8
Adding an user email address to the list before confirming.#3923	Informative	Misconfiguration and Insecure Design	–	2014-06-11	–	8
Weird Bug - Ability to see partial of other user's notification#2584	Valid	No weakness recorded	–	2014-04-19	–	8
Redirect FILTER bypass in report/comment#28865	Valid	Open Redirect	–	2014-10-19	$500	6
Flooding mailbox of user#10109	Informative	Misconfiguration and Insecure Design	–	2014-04-30	–	6
creating titleless and non-closable bugs#6350	Valid	No weakness recorded	–	2014-04-17	–	6
Securing sensitive pages from SearchBots#3986	Valid	Misconfiguration and Insecure Design	–	2014-04-20	–	6
harvesting attack on user registration#2193	Informative	No weakness recorded	–	2014-05-19	–	6
No option to logout concurrent sessions#20122	Informative	No weakness recorded	–	2014-07-17	–	5
Improper filtering of classes used in codeblocks in Markdown#12815	Valid	Cross-site Scripting	–	2014-07-08	–	5
Breaking Bugs as team member#38232	Valid	Denial of Service	–	2014-12-09	–	4
Window Opener Property Bug#27987	Valid	No weakness recorded	–	2014-10-28	–	4
Account Hijacking (Only rare case scenario)#21083	Informative	Authentication	–	2014-08-23	–	4
Cache leads to Privacy leaks#17105	Valid	Authentication	–	2014-07-17	–	4
Arbitrary file uploads to Amazon WS.#7929	Informative	Misconfiguration and Insecure Design	–	2014-04-26	–	4
Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!)#3709	Valid	Cryptography	–	2014-04-22	–	4
Potential denial of service in hackerone.com/teams/new#13748	Valid	Denial of Service	–	2014-06-20	–	3
Notification of previous signed out user leakage.#26395	Informative	Information Disclosure	–	2014-09-01	–	2

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-15.