Email address of any user can be queried on Report Invitation GraphQL type when username is known Analysed #792927 Valid Access Control High 2020-02-20 – 671 Customer private program can disclose email any users through invited via username Analysed #807448 Valid Information Disclosure High 2020-05-15 $7,500 589 profile-picture name parameter with large value lead to DoS for other users and programs on the platform Analysed #764434 Valid Denial of Service Medium 2020-03-25 – 475 Reflected XSS on www.hackerone.com and resources.hackerone.com Analysed #840759 Valid Cross-site Scripting Low 2020-05-05 $500 387 Getting New Invitations without Leaving Programs Analysed #999789 Valid Input Validation and Logic Low 2020-10-15 – 322 Reflected XSS on www.hackerone.com via Wistia embed code Analysed #986386 Valid Cross-site Scripting Low 2020-09-24 $500 236 Uploading large payload on domain instructions causes server-side DoS Analysed #887321 Valid Denial of Service Medium 2020-06-20 $2,500 210 2020-10-09 Credential Stuffing Attack Analysed #1007689 Valid No weakness recorded – 2020-10-13 – 196 An invite-only's program submission state is accessible to users no longer part of the program Analysed #800109 Valid Information Disclosure Low 2020-04-21 $500 194 Unauthorized access to metadata of undisclosed reports that were retested Analysed #871749 Valid Information Disclosure Medium 2020-06-05 – 189 404-response contains debug-information with all headers Analysed #792998 Valid Information Disclosure Low 2020-05-16 – 173 Total Paid Bounty Paid can be disclose Analysed #674757 Valid Information Disclosure Low 2020-02-28 $500 168 Race Condition leads to undeletable group member Analysed #604534 Valid Race Conditions Low 2020-03-20 – 153 Team object in GraphQL disclosed private_comment Analysed #978143 Valid Information Disclosure Medium 2020-09-10 $2,500 146 Unauthorized user can obtain `report_sources` attribute through Team GraphQL object Analysed #770209 Valid Information Disclosure Medium 2020-02-10 $2,500 142 Recently added 'Country' field doesn't send email notification when changed Analysed #961841 Valid Misconfiguration and Insecure Design Low 2020-08-25 – 108 GraphQL field on Team node can be used to determine if External Program runs invite-only program Analysed #877642 Valid Information Disclosure Medium 2020-07-25 $2,500 107 Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted request Analysed #861170 Valid Denial of Service Low 2020-05-25 – 97 Subdomain takeover of resources.hackerone.com Analysed #863551 Valid No weakness recorded Low 2020-05-15 $500 95 Security@ email forwarding and Embedded Submission drafts can be used to obtain copy of deleted attachments from other HackerOne users Analysed #1034346 Valid Insecure Direct Object Reference High 2020-11-17 – 91 "Bounties paid in the last 90 days" discloses the undisclosed bounty amount in program statistics Analysed #696266 Valid Information Disclosure Low 2020-02-21 $500 86 Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com) Analysed #995995 Valid Cross-site Scripting None 2020-11-09 – 84 Login CSRF vulnerability on hackerone.com Analysed #834366 Valid Cross-Site Request Forgery Low 2020-06-12 $500 84 Near to Infinite loop when changing Group's name that has API token as Team Member Analysed #880187 Valid No weakness recorded Medium 2020-07-23 $2,500 77 Pentester can obtain information about other pentesters who applied for the same test, but weren't accepted Analysed #958374 Valid Information Disclosure Low 2020-08-24 $500 74 Making program preference -> program visibilty feature usless and disclosing API Identifier in the progress and data that may cause potential IDORS. Analysed #929361 Valid Information Disclosure Low 2020-10-02 – 71 The hacker has access to the administrative part of the management reports in publish report Analysed #867249 Valid No weakness recorded Low 2020-12-16 $500 71 Potential stored Cross-Site Scripting vulnerability in Support Backend Analysed #858894 Valid Cross-site Scripting Medium 2020-05-04 – 71 Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects Analysed #781175 Valid Access Control Medium 2020-03-20 – 59 Disclosure of the name of a program that has a private part with an external link Analysed #871142 Valid Information Disclosure Low 2020-05-22 $500 46 GraphQL node interface for ActiveResource models lacks encoding for resource identifier, enabling parameter injection in Payments backend Analysed #800231 Valid Information Disclosure Medium 2020-05-11 – 42 Read-only team members can read all properties of webhooks Analysed #818848 Valid Access Control Low 2020-04-29 – 30 A team member of the program with Report rights can ban the Admin Analysed #816143 Valid Input Validation and Logic Low 2020-05-15 – 30 HackerOne Pentesters can access any structured scope object through GraphQL node interface #781150 Valid Access Control High 2020-03-11 – 30 SAML Response Reuse on hackerone.com/users/saml/auth #888930 Valid Authentication Low 2020-07-24 – 26 Disabled account can still use GraphQL endpoint #608656 Valid Access Control Low 2020-03-12 – 24 program_analytics_benchmarks query shows information not visible in public #826176 Valid Information Disclosure Low 2020-03-27 – 22 Rounding errors on rewarding a bounty leads to bypassing the 20% H1 commission fee #808975 Valid Input Validation and Logic Low 2020-05-15 – 22 Graphql: Sorting the reports by jira_status field resulted to different value #955286 Valid Access Control Low 2020-08-27 – 20 Attacker may be able to bounce enough emails which suspend HackerOne's SES service and cause a DoS of HackerOne's email service #823915 Valid Denial of Service Medium 2020-06-12 – 18 Changes to data in a CVE request after draft via GraphQL query #813300 Valid Other weaknesses Low 2020-05-15 – 15 Mismatch between frontend and backend validation via `ban_researcher` leads to H1 support and hackers email spam #808755 Valid Input Validation and Logic Low 2020-05-15 – 7