Parameter pollution in social sharing buttons Analysed #105953 Valid Misconfiguration and Insecure Design – 2015-12-19 $500 62 Email spoofing #575 Valid Misconfiguration and Insecure Design – 2015-05-28 – 28 Improperly validated fields allows injection of arbitrary HTML via spoofed React objects #49652 Valid Cross-site Scripting – 2015-03-18 $5,000 23 Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered #46072 Valid Cross-site Scripting – 2015-02-03 $5,000 21 HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com #97292 Valid No weakness recorded – 2015-12-02 – 18 PNG compression DoS #454 Valid Denial of Service – 2015-05-28 $500 18 Homograph attack #59375 Valid Misconfiguration and Insecure Design – 2015-05-09 – 17 Markdown parsing issue enables insertion of malicious tags and event handlers #46916 Valid Cross-site Scripting – 2015-04-07 $5,000 16 Flawed account creation process allows registration of usernames corresponding to existing file names #275 Valid No weakness recorded – 2015-06-08 – 16 Pre-generation of 2FA secret/backup codes seems like an unnecessary risk #100509 Valid No weakness recorded – 2015-12-02 $1,000 15 Logical issues with account settings #546 Valid Misconfiguration and Insecure Design – 2015-05-28 – 15 Gain reputation by creating a duplicate of an existing report #35237 Valid Misconfiguration and Insecure Design – 2015-08-14 – 14 CSV Injection with the CVS export feature #72785 Valid Command and Code Injection – 2015-09-21 – 13 Open redirect in "Language change". #52035 Valid Open Redirect – 2015-06-19 $500 12 CSRF possible when SOP Bypass/UXSS is available #103787 Valid Cross-Site Request Forgery – 2015-12-30 $2,500 11 Privilege escalation..., or not?! #345 Valid Misconfiguration and Insecure Design – 2015-06-08 – 11 RTL override symbol not stripped from file names #298 Valid Misconfiguration and Insecure Design – 2015-05-28 – 11 CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain #47472 Valid Cross-Site Request Forgery – 2015-02-26 $2,000 10 Limited CSRF bypass. #99708 Valid Cross-Site Request Forgery – 2015-12-02 $500 9 "early preview" programs disclosure #29185 Informative Information Disclosure – 2015-01-21 – 9 Anti-MIME-Sniffing header X-Content-Type-Options header has not been set. #9479 Valid Misconfiguration and Insecure Design – 2015-04-28 – 9 Restrict any user from logging into his account. #48416 Valid Authentication – 2015-03-24 – 8 Insecure Direct Object Reference vulnerability #46397 Valid Misconfiguration and Insecure Design – 2015-02-20 $500 8 Logic Issue with Reputation: Boost Reputation Points #36211 Valid Misconfiguration and Insecure Design – 2015-04-28 – 8 javascript: and mailto: links are allowed on users' profiles #4184 Valid Cross-site Scripting – 2015-05-13 – 8 Autocomplete enabled in Paypal preferences #842 Valid Misconfiguration and Insecure Design – 2015-05-28 – 8 Report title autocompletion #263 Valid Information Disclosure – 2015-06-08 – 8 Team Member███ associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports #106084 Valid Authentication – 2015-12-29 $500 7 Send AJAX request to external domain #97191 Valid Cross-site Scripting – 2015-11-14 – 7 Accessing title of the report of which you are marked as duplicate #75556 Valid Authentication – 2015-07-17 $500 7 "learn more here", reward email - domain expired. #52532 Valid Open Redirect – 2015-03-23 – 7 In markdown, parsing things like @danlec and #46072 after links is unsafe #46312 Valid No weakness recorded – 2015-07-04 – 7 profile cover can also load external URL's #99687 Valid Misconfiguration and Insecure Design – 2015-12-02 – 6 Cross-domain AJAX request #97948 Valid Open Redirect – 2015-11-14 – 6 Invitation is not properly cancelled while inviting to bug reports. #66151 Valid Authentication – 2015-07-10 – 6 Logical Issue (Boosting Reputation points) #60429 Informative No weakness recorded – 2015-07-21 – 6 Reopen Disable Accounts/ Hidden Access After Disable #59659 Valid Authentication – 2015-06-08 – 6 Making any Report Failed to load #59369 Valid Denial of Service – 2015-05-09 – 6 Open-redirect on hackerone.com #57163 Valid Open Redirect – 2015-04-23 – 6 SPF whitelist of mandrill leads to email forgery #56742 Valid Authentication – 2015-06-08 – 6 Auto Approval of Invitation to join Team as a Team member #49566 Valid Misconfiguration and Insecure Design – 2015-03-11 – 6 Team member invitations to sandboxed teams are not invalidated consistently (v2) #48422 Valid Access Control – 2015-02-27 – 6 Markdown code block sequence makes report unreadable #46952 Valid No weakness recorded – 2015-06-29 – 6 Enumeration/Guess of Private (Invited) Programs #32990 Valid Misconfiguration and Insecure Design – 2015-05-09 – 6 Minimum bounty of a private program is visible for users that were removed from the program #94336 Valid Information Disclosure – 2015-10-21 – 5 Minor Bug: Public un-compiled CSS with original sass, versioning, source map, comments, etc. #90367 Valid Information Disclosure – 2015-09-25 – 5 mailto: link injection on https://hackerone.com/directory #66262 Valid Misconfiguration and Insecure Design – 2015-06-10 – 5 Potential denial of service in hackerone.com/<program>/reward_settings #63865 Valid Denial of Service – 2015-06-10 – 5 Email Notification should be get while changing Paypal Email #62827 Valid Authentication – 2015-06-19 – 5 Content Spoofing - External Link Warning Page #60402 Valid Misconfiguration and Insecure Design – 2015-05-11 – 5