Partial disclosure of report activity through new "Export as .zip" feature Analysed #182358 Valid Information Disclosure – 2016-11-29 $10,000 355 Internal attachments can be exported via "Export as .zip" feature Analysed #186230 Valid Information Disclosure – 2016-11-30 $12,500 269 Web Authentication Endpoint Credentials Brute-Force Vulnerability Analysed #127844 Valid Authentication – 2016-06-23 – 161 Hacker.One Subdomain Takeover Analysed #159156 Valid Misconfiguration and Insecure Design – 2016-09-20 – 154 Race Conditions in Popular reports feature. Analysed #146845 Valid Memory Corruption – 2016-08-03 – 125 Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?) #170310 Valid Misconfiguration and Insecure Design – 2016-12-08 – 76 (HackerOne SSO-SAML) Login CSRF, Open Redirect, and Self-XSS Possible Exploitation #171398 Valid Cross-site Scripting – 2016-10-27 – 44 AWS S3 bucket writeable for authenticated aws users #128088 Valid Authentication – 2016-04-05 – 42 Information leakage of private program #159526 Valid Information Disclosure – 2016-08-18 $500 35 RCE in profile picture upload #135072 Valid Command and Code Injection – 2016-06-08 – 32 Non-secure requests are not automatically upgraded to HTTPS #158186 Valid No weakness recorded – 2016-08-19 – 30 Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session #111968 Valid Open Redirect – 2016-02-24 – 28 Ability to enumerate private programs using SAML #167828 Valid Information Disclosure – 2016-09-14 – 24 Hackerone Email Addresses Enumeration #2429 Informative Information Disclosure – 2016-06-17 – 24 Know undisclosed Bounty Amount when Bounty Statistics are enabled. #148050 Valid Information Disclosure – 2016-09-02 – 23 HTML injection can lead to data theft #110578 Valid Misconfiguration and Insecure Design – 2016-01-26 $500 21 Possible CSRF during joining report as participant #148517 Valid Cross-Site Request Forgery – 2016-07-12 – 18 Unintended HTML inclusion as a result of https://hackerone.com/reports/110578 #112935 Valid No weakness recorded – 2016-02-24 – 18 Know whether private program for company exist or not #105887 Valid Information Disclosure – 2016-01-15 – 18 Users contents on AWS is cacheable #163131 Valid Information Disclosure – 2016-09-06 – 16 Ability to monitor reports' submission in real time #159890 N/A Access Control – 2016-08-17 – 16 Old titles are not hidden in reports with limited disclosure #144129 Valid Information Disclosure – 2016-06-21 – 16 Researcher gets email updates on a private program after he/she quits that program. #174449 Valid Information Disclosure – 2016-11-21 – 15 Able to remove the admin access of my program #141629 Valid Misconfiguration and Insecure Design – 2016-07-06 – 15 Inadequate access controls in "Vote" functionality??? #137503 Valid Access Control – 2016-05-12 – 15 Report title and issue information prepopulated #111868 N/A No weakness recorded – 2016-07-15 – 15 Obtain the username & the uid of the one doing the S3 sync on Hackerone #173175 Valid Information Disclosure – 2016-10-03 – 14 Race Conditions Exist When Accepting Invitations #119354 Valid Misconfiguration and Insecure Design – 2016-04-26 – 14 Requesting Mediation possible on reports that are too old for mediation #159512 Valid Access Control – 2016-08-17 – 13 Possible CSRF during external programs #174470 Valid Cross-Site Request Forgery – 2016-10-18 – 12 Manipulate report timeline activity by using null byte. #133322 Informative Misconfiguration and Insecure Design – 2016-07-01 – 12 Unauthorized Team members viewing #123572 Informative Authentication – 2016-07-02 – 12 Improve signals in reputation #106305 Valid Misconfiguration and Insecure Design – 2016-01-07 – 12 All Active user sessions should be deleted when user change his password! #9950 Valid Misconfiguration and Insecure Design – 2016-04-25 $100 11 Reward Money Leakage #149435 Informative Information Disclosure – 2016-08-09 – 10 New hacktivity view discloses report IDs of non-public reports #127620 Valid Misconfiguration and Insecure Design – 2016-04-05 $500 10 CSV Injection via the CSV export feature #111192 Valid Command and Code Injection – 2016-02-16 – 10 Reflected File Download #39658 Valid Misconfiguration and Insecure Design – 2016-04-25 – 10 LinkedIN URL should be HTTPS #1093 Valid No weakness recorded – 2016-05-18 – 10 Information disclosure via policy update notifications after removal from program #177484 Valid Information Disclosure – 2016-10-29 – 9 Disclosure of external users invited to a specific report #157699 Valid Information Disclosure – 2016-09-01 – 9 Reputation Manipulation (Theoretical) #132057 N/A Misconfiguration and Insecure Design – 2016-04-19 – 9 Private program activity timeline information disclosure #116029 Valid Authentication – 2016-03-16 – 9 Reflected Filename Download #54034 Valid Command and Code Injection – 2016-04-25 – 9 External programs revealing info #124929 Valid Authentication – 2016-04-01 $1,500 8 External links should use rel="noopener" or use the redirect service #124620 Valid Open Redirect – 2016-04-05 – 8 Increase number of bugs by sending duplicate of your own valid report #116951 Valid Misconfiguration and Insecure Design – 2016-04-25 – 8 Deleted name still present via mouseover functionality for user accounts #127914 Valid Information Disclosure – 2016-04-21 – 7 Null byte injection #116189 Valid No weakness recorded – 2016-02-23 – 7 Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants #107336 Valid Access Control – 2016-01-27 – 7