Denial of service via cache poisoning Analysed #409370 Valid Denial of Service Medium 2018-12-22 $2,500 253 Race condition in performing retest allows duplicated payments Analysed #429026 Valid Race Conditions Medium 2018-12-27 – 240 Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form Analysed #418767 Valid Access Control Medium 2018-10-31 $10,000 208 Markdown parsing issue enables insertion of malicious tags and event handlers Analysed #299728 Valid Cross-site Scripting High 2018-01-29 $5,000 184 SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameter Analysed #435066 Valid SQL Injection Critical 2018-11-30 – 174 IE only: stored Cross-Site Scripting (XSS) vulnerability through Program Asset identifier Analysed #449351 Valid Cross-site Scripting Medium 2018-11-27 $2,500 156 h1-202 leaderboard photo discloses local wifi password Analysed #329798 Valid Authentication Medium 2018-03-25 – 145 Blind SSRF on errors.hackerone.net due to Sentry misconfiguration Analysed #374737 Valid Server-Side Request Forgery Low 2018-07-04 $3,500 143 Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com Analysed #374919 Valid Cross-site Scripting Medium 2018-08-04 – 129 Harvesting all private invites using leave program fast-tracked invitation and security@ email forwarding feature Analysed #334205 Valid Input Validation and Logic Medium 2018-04-18 $2,500 103 Team object in GraphQL disclosed total number of whitelisted hackers Analysed #342978 Valid Information Disclosure Medium 2018-05-12 $2,500 93 A user can bypass approval step in Hacker Publishing feature, allowing them to publish reports immediately Analysed #452959 Valid Access Control Medium 2018-12-05 $2,500 90 Unauthenticated user can upload an attachment to the last updated report draft Analysed #419896 Valid Memory Corruption High 2018-10-09 – 87 Improper UUID validation results in bypass of #419896 Analysed #423073 Valid Input Validation and Logic High 2018-10-25 – 82 Team object in GraphQL discloses team group names and permissions Analysed #343464 Valid Information Disclosure Medium 2018-05-04 $2,500 75 The request tells the number of private programs, the new system of authorization /invite/token Analysed #310946 Valid Information Disclosure Medium 2018-02-14 $2,000 71 Inline banner on Report page discloses whether organization runs a private program Analysed #452973 Valid Information Disclosure Low 2018-12-11 $500 67 HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms Analysed #298265 Valid No weakness recorded None 2018-03-13 – 65 Program metrics disclosed response_efficiency_percentage via /program_name json response despite the team decided not to show on their profile Analysed #347693 Valid Information Disclosure Medium 2018-05-08 $2,500 64 TeamProfile exposes partially sensitive information through GraphQL Analysed #389600 Valid Information Disclosure Low 2018-08-08 – 60 HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information Analysed #378122 Valid Information Disclosure None 2018-07-26 – 60 Team object exposes amount of participants in a private program to non-invited users Analysed #380317 Valid Information Disclosure Medium 2018-07-20 – 59 Private program policy page still accessible after user left the program Analysed #386997 Valid Information Disclosure Medium 2018-08-12 $2,500 57 Email Forwarding invitations for Drafts are not marked as accepted, allowing multiple users to join a program after disabling Email Forwarding Analysed #331691 Valid Input Validation and Logic Low 2018-04-18 $500 54 Open Redirection in index.php page Analysed #320376 Valid Open Redirect None 2018-03-07 – 53 Extra program metrics disclosed via /PROGRAM_NAME json response Analysed #327088 Valid Information Disclosure Medium 2018-03-28 – 51 Domain spoofing in redirect page using RTLO Analysed #299403 Valid Open Redirect Low 2018-01-30 – 48 Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session Analysed #417382 Valid Authentication Low 2018-11-30 $500 47 Hacktivity of a private program visible to banned user if he gets invited to a program by hackbot Analysed #357485 Valid Access Control Low 2018-06-27 $500 45 ImageMagick GIF coder vulnerability leading to memory disclosure Analysed #302885 Valid Information Disclosure Low 2018-02-07 $500 44 Proper verification is not done before sending invitations to researchers for certain private programs with rules e.g. "Participants must be US-based" Analysed #427502 Valid Access Control Medium 2018-11-07 $2,500 43 HackerOne support disclosing report state without checking user identity Analysed #356566 Valid No weakness recorded Low 2018-06-02 $500 43 Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature Analysed #397031 Valid Information Disclosure Low 2018-11-07 – 42 User with privilege to maintain External Programs can update certain churned HackerOne programs Analysed #411930 Valid Access Control Low 2018-10-25 $500 41 Team object in GraphQL that have a published external program may expose existence of a private program Analysed #347937 Valid Information Disclosure None 2018-07-04 – 39 Private program email forwarding response invitation not expire after first use. Analysed #209140 Valid Misconfiguration and Insecure Design High 2018-05-30 – 38 Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion Analysed #297181 Valid Misconfiguration and Insecure Design Low 2018-01-22 $500 37 Invitation token leaks to https://bat.bing.com Analysed #301526 Valid Information Disclosure Low 2018-01-11 – 36 Updating payout preference to CurrencyCloud doesn't notify user via email Analysed #240083 Valid Misconfiguration and Insecure Design None 2018-01-31 $500 35 Accidental Access to Programs Information via SAML Login Analysed #438306 Valid No weakness recorded Critical 2018-11-14 – 34 Timing attack towards endpoints on the web without CSRF #348168 Duplicate Information Disclosure Low 2018-12-27 – 34 Attacker can claim credentials for private program that has a published external program #449680 Valid Information Disclosure Medium 2018-11-29 – 32 Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties #395518 Valid Information Disclosure Low 2018-08-17 – 32 CSRF at [Apply to this program] that lead to submit your request automatic with out any validations #334253 Valid Misconfiguration and Insecure Design Low 2018-07-05 – 30 Can read features from any user #316810 Valid Information Disclosure Medium 2018-03-12 $250 28 A user can request a report to be retested even though the program has not been verified by HackerOne #448078 Valid Access Control Low 2018-12-27 – 27 Program profile_metrics.json contains time to triage for deptofdefense even it's turned off #318399 Valid Information Disclosure None 2018-03-09 $250 27 Unicorn worker pool exhaustion by continuously updating payout preferences #317543 Valid Denial of Service Medium 2018-03-30 – 25 User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program #350964 Valid Information Disclosure None 2018-06-27 – 24 Hacker can request mediation for published reports #412988 Valid Access Control Low 2018-11-27 $500 23