Account takeover via leaked session cookie Analysed #745324 Valid Authentication High 2019-12-03 $20,000 1,642 Confidential data of users and limited metadata of programs and reports accessible via GraphQL Analysed #489146 Valid Information Disclosure Critical 2019-02-03 – 1,033 How the Bug stole hacking Analysed #762510 Valid Insecure Direct Object Reference None 2019-12-20 – 471 Team member with Program permission only can escalate to Admin permission Analysed #605720 Valid Access Control Medium 2019-06-26 – 268 Cross-site Scripting (XSS) on HackerOne careers page Analysed #474656 Valid Cross-site Scripting Low 2019-02-17 $500 239 Manipulate hacker profile and private program hacktivity to expose your name as researchers who is actively submitting reports with resolve status Analysed #654198 Valid Information Disclosure Low 2019-09-29 $500 213 DOM Based XSS in www.hackerone.com via PostMessage Analysed #398054 Valid Cross-site Scripting Low 2019-02-21 $500 208 Disclosure of `payment_transactions` for programs via GraphQL query Analysed #707433 Valid Information Disclosure Medium 2019-12-01 – 178 Unreleased CTF Levels are Revealed on /group/user/ID1?user=USERID endpoint Analysed #536853 Valid Insecure Direct Object Reference Low 2019-04-23 – 161 Client-Side Race Condition using Marketo, allows sending user to data-protocol in Safari when form without onSuccess is submitted on www.hackerone.com Analysed #381356 Valid Input Validation and Logic Low 2019-04-05 – 154 Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report Analysed #410015 Valid Information Disclosure Medium 2019-04-24 $3,000 147 Banned researcher gets email updates on a private program. Analysed #271506 Valid No weakness recorded – 2019-05-18 – 139 Private program disclosure via `vpn_suspended` GraphQL query Analysed #715192 Valid Information Disclosure None 2019-10-21 $2,500 138 Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible Analysed #685909 Valid Information Disclosure Medium 2019-11-08 – 127 Account recovery text message is sending a wrong domain to users. Analysed #549364 Valid Input Validation and Logic Low 2019-05-31 – 117 @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant. Analysed #397792 Valid Input Validation and Logic Medium 2019-01-02 – 117 Emails of invited collaborators are disclosed in full in payload for report participants Analysed #269230 Valid Information Disclosure Low 2019-04-09 – 112 ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages Analysed #713407 Valid Denial of Service Medium 2019-12-13 – 111 DOM Based XSS in www.hackerone.com via PostMessage (bypass of #398054) Analysed #499030 Valid Cross-site Scripting Low 2019-05-04 – 106 [Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content" Analysed #669438 Valid No weakness recorded Low 2019-09-09 $500 104 Password not checked when disabling 2FA on HackerOne Analysed #587910 Valid Misconfiguration and Insecure Design Low 2019-06-07 – 95 Race Condition in Flag Submission Analysed #454949 Valid Race Conditions Low 2019-07-22 – 94 Private information exposed through GraphQL filters Analysed #645299 Valid Information Disclosure Medium 2019-07-23 – 81 latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users Analysed #724944 Valid Information Disclosure Low 2019-11-10 – 79 Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent Analysed #717729 Valid Insecure Direct Object Reference Medium 2019-10-25 – 76 Team object in GraphQL disclosed of private programs via the industry Analysed #707406 Valid No weakness recorded Low 2019-11-23 $500 72 Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeover Analysed #514451 Valid Server-Side Request Forgery None 2019-04-04 $500 68 IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs Analysed #510759 Valid Insecure Direct Object Reference Low 2019-09-06 – 67 Any user with access to program can resume and suspend HackerOne Gateway Analysed #717716 Valid Insecure Direct Object Reference Medium 2019-10-21 – 65 Disclosure of Email title report in quick award paypout email (no content mode) Analysed #689997 Valid Information Disclosure Low 2019-10-11 $500 62 Race condition in claiming program credentials Analysed #488985 Valid Race Conditions Low 2019-05-19 – 54 Embedded submission form UUIDs can be enumerated through GraphQL node interface, exposing sensitive program details Analysed #447930 Valid Insecure Direct Object Reference High 2019-01-11 – 54 Total bounties paid amount is disclosed because of redesign of the Program Profiles Analysed #640488 Valid Information Disclosure Low 2019-08-02 – 50 View HackerOne challenge scope before challenge begins Analysed #565736 Valid Access Control Low 2019-07-11 – 48 Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled Analysed #634679 Valid Access Control Medium 2019-07-05 – 47 Response program can display "eligible for bounty" in scope area in program policy Analysed #475660 Valid Input Validation and Logic Low 2019-01-30 $500 47 Response program can create bounty table Analysed #460920 Valid Input Validation and Logic Low 2019-01-07 $500 46 API Last Request Date/Time Not Updating Analysed #220774 Valid Input Validation and Logic Low 2019-05-19 – 45 Disclosing a private program in an external link if program is paused Analysed #418474 Valid No weakness recorded Low 2019-06-28 $500 44 Repeated mediation requests and multiple emails possible on a report. Analysed #156948 Valid No weakness recorded – 2019-04-11 $500 44 Hogging up all the resources on hackerone.com Analysed #125587 Valid Denial of Service Medium 2019-04-10 – 44 User login page doesn't implement any form of rate limiting Analysed #410451 Valid Authentication Low 2019-01-04 – 42 Path traversal leading to limited CSRF on GET requests on two endpoints Analysed #301862 Valid No weakness recorded – 2019-04-05 – 41 Disclosure of Program email Title Report when being removed as contributor. Bypass for Report #645264 Analysed #669776 Valid Information Disclosure Low 2019-09-06 – 39 Open redirect vulnerability in index.php Analysed #439075 Valid Open Redirect None 2019-02-03 – 39 HackerOne Integrations Design Issue Analysed #172289 Valid Misconfiguration and Insecure Design Medium 2019-04-11 $500 36 Program Email Nofication settings ignored when being added as an external contributor Analysed #645264 Valid Information Disclosure Low 2019-08-07 – 34 IDOR in Bugs overview enables attacker to determine the date range a hackathon was active Analysed #663431 Valid Insecure Direct Object Reference Low 2019-12-13 – 33 Open Redirection in [https://www.hackerone.com/index.php] Analysed #562417 Valid Open Redirect None 2019-05-08 – 33 A small set of users were assigned someone else's payout preference Analysed #498845 Valid Information Disclosure Low 2019-02-20 – 30