WannaCrypt “Killswitch” Analysed #228648 Valid No weakness recorded – 2017-05-13 – 809 Information Disclosure in /skills call Analysed #188719 Valid Information Disclosure – 2017-01-05 $10,000 287 Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP Analysed #207042 Valid Misconfiguration and Insecure Design – 2017-08-29 – 153 Disclose any user's private email through API Analysed #196655 Valid Information Disclosure – 2017-02-24 – 140 Subdomain takeover at info.hacker.one Analysed #202767 Valid Access Control – 2017-03-27 – 134 Reading redacted data via hackbot's answers Analysed #247628 Valid Information Disclosure – 2017-07-27 $1,500 93 IDOR on HackerOne Feedback Review #262661 Valid Insecure Direct Object Reference – 2017-09-02 – 79 Subdomain takeover #2 at info.hacker.one #209004 Valid Access Control – 2017-04-28 – 78 A HackerOne employee's GitHub personal access token exposed in Travis CI build logs #215625 Valid Information Disclosure – 2017-05-23 $2,000 75 Validation message in Bounty award endpoint can be used to determine program balances #293299 Valid Information Disclosure – 2017-11-29 – 73 Race condition leads to duplicate payouts #220445 Valid Access Control – 2017-05-23 – 73 Homograph fix Bypass #271324 Valid Misconfiguration and Insecure Design – 2017-10-16 – 71 Query parameter reordering causes redirect page to render unsafe URL #293689 Valid Cross-site Scripting – 2017-11-30 $1,500 61 Report Private Links Leaks to Google Analytics via Query String Param #269479 Valid Information Disclosure – 2017-10-25 – 59 Subdomain takeover #3 at info.hacker.one #217358 Valid Access Control – 2017-06-21 – 58 Invalid Host detection at https://hackerone.com/redirect #278095 Valid Misconfiguration and Insecure Design – 2017-12-03 – 57 Subdomain takeover #4 at info.hacker.one #220002 Valid Access Control – 2017-06-21 – 50 Websites opened from reports can change url of report page #189726 Valid Open Redirect – 2017-02-25 – 50 Adding or removing a new non-preferred payout method does not trigger an e-mail or account notification #242964 Valid Input Validation and Logic – 2017-11-01 – 46 Content Security Policy not applied to error pages at multiple HackerOne endpoints #250729 Valid Misconfiguration and Insecure Design – 2017-12-12 – 45 Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com #199779 Valid Misconfiguration and Insecure Design – 2017-03-26 – 44 IE 11 Self-XSS on Jira Integration Preview Base Link #212721 Valid Cross-site Scripting – 2017-03-29 $750 42 Report invitation links not restricted to any existing user #214839 Valid Information Disclosure – 2017-05-23 $500 39 HackerOne reports escalation to JIRA is CSRF vulnerable #226418 Valid Cross-Site Request Forgery – 2017-08-30 $500 36 Changing Victim's JIRA Integration Settings Through Multiple Bugs #226199 Valid Input Validation and Logic – 2017-05-23 $1,000 36 IDOR on Program Visibilty (Revealed / Concealed) against other team members #291721 Duplicate Insecure Direct Object Reference – 2017-11-23 – 33 View Any Program's Team Members through GET https://hackerone.com/invitations/ #283014 Valid Information Disclosure – 2017-11-01 $1,000 32 Invitation tokens leak to Google Analytics #237262 Valid Information Disclosure – 2017-07-16 – 32 Blind SSRF in "Integrations" by abusing a bug in Ruby's native resolver. #287245 Valid Server-Side Request Forgery – 2017-11-09 – 30 Program profile metrics endpoint contains mean time to triage, even when turned off #289568 Valid Information Disclosure – 2017-11-14 – 29 Information leakage via CSV when content is valid JavaScript #207266 Valid Cross-Site Request Forgery – 2017-05-23 – 29 Able To Check The Exact Bounty Balance of any Bug Bounty Program #293593 Duplicate Information Disclosure – 2017-12-06 – 27 Report redaction doesn't apply to report title update activities #196358 Valid Misconfiguration and Insecure Design – 2017-02-25 – 27 resolved bugs in a program are public despite the program settings #270993 Valid Information Disclosure – 2017-10-13 – 25 Lack of input sanitization in Marketo form leads to execution of HTML in lead emails #220009 Valid Server-Side Request Forgery – 2017-10-03 $500 25 Transitioning a Private Program to Public Does Not Clear Previously Private Updates to Hackers #210190 Valid Information Disclosure – 2017-04-05 $500 24 HackerOne is still prone to Internet Explorer UXSS #108056 Informative Cross-Site Request Forgery – 2017-04-19 – 23 Introspection query leaks sensitive graphql system information. #291531 Duplicate Misconfiguration and Insecure Design – 2017-11-22 – 22 CRLF injection in info.hacker.one #217058 Valid Injection and Smuggling – 2017-05-03 – 21 Additional bypass allows SSRF for internal netblocks #288950 Valid Server-Side Request Forgery – 2017-11-16 – 20 Able to create basic user account via Google login on HackerOne Drupal CMS #208407 Valid Authentication – 2017-04-25 – 20 Missing Certificate Authority Authorization rule #129992 Valid Cryptography – 2017-08-17 – 20 Insecure SHA1withRSA in b5s.hackerone-ext-content.com and a4l.hackerone-ext-content.com #225754 Valid Cryptography – 2017-06-21 – 19 Limited Open redirection using SSO-SAML #178345 Valid Open Redirect – 2017-03-26 – 19 Private partial disclosure of h1 infrastructure #283361 Valid Information Disclosure – 2017-11-03 – 17 www.hackerone.com website CSP "script-src" includes "unsafe-inline" #225833 Valid Misconfiguration and Insecure Design – 2017-05-23 – 17 Example HackerOne security@ forward domain is not registered #218705 Valid Misconfiguration and Insecure Design – 2017-04-10 – 17 javascript: and mailto: links are allowed in JIRA integration settings #209917 Duplicate Misconfiguration and Insecure Design – 2017-04-10 – 12 GraphQL sessions aren't immediately invalidated when user password is changed #283847 Valid Misconfiguration and Insecure Design – 2017-11-30 – 9 Search query text, including from potentially undisclosed reports, sent to Google Analytics on Inbox query page #280770 Valid Information Disclosure – 2017-11-01 – 9