Hackerone is not properly deleting user id Analysed #1133118 Valid Input Validation and Logic Medium 2021-06-11 – 356 Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack Analysed #1181946 Valid Denial of Service Medium 2021-12-22 – 228 HackerOne Jira integration plugin Leaked JWT to unauthorized jira users Analysed #1103582 Valid Authentication Medium 2021-04-01 $3,000 213 HackerOne making payments in USDC (Coinbase stable coin) Analysed #1220747 Valid No weakness recorded None 2021-06-17 – 201 Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos Analysed #1034257 Valid Misconfiguration and Insecure Design Medium 2021-03-25 – 194 Slack integration setup lacks CSRF protection Analysed #170552 Valid Cross-Site Request Forgery High 2021-07-07 $2,500 149 Stored XSS in IE11 on hackerone.com via custom fields Analysed #1173040 Valid Cross-site Scripting Medium 2021-06-24 – 146 Disclosure handle private program with external link Analysed #1276992 Valid No weakness recorded Medium 2021-08-24 $2,500 130 Leaked H1's Employees Email addresses,meeting info on private bug bounty program ████████ Analysed #1285115 Valid Information Disclosure Medium 2021-11-08 – 118 Internal Gitlab Ticket Disclosure via External Slack Channels Analysed #1273292 Valid Information Disclosure High 2021-08-04 – 118 Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent] Analysed #1043372 Valid Denial of Service Low 2021-02-02 – 83 Private program disclosure of `██████████` through notifications Analysed #1179241 Valid Access Control Low 2021-06-09 $500 66 Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering Analysed #1132606 Valid Information Disclosure Medium 2021-08-24 – 66 Hackers can find out the ID of private programs Analysed #1129649 Valid Information Disclosure Low 2021-08-24 – 64 Second-order SOQL injection through email and campaign name parameter in Salesforce lead submission Analysed #1039821 Valid No weakness recorded Low 2021-06-18 – 64 Partial report contents leakage - via HTTP/2 concurrent stream handling Analysed #493176 Valid Information Disclosure Medium 2021-08-05 $2,500 64 Stored XSS on https://events.hackerone.com Analysed #1028332 Valid Cross-site Scripting None 2021-03-26 – 59 HackerOne Staging uses Production data for testing Analysed #1392511 Valid Information Disclosure Low 2021-11-05 – 58 Changing the 2FA secret key and backup codes without knowing the 2FA OTP Analysed #1139535 Valid Other weaknesses Medium 2021-05-06 – 57 Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.io Analysed #1028345 Valid Open Redirect None 2021-03-26 – 54 New link opening method makes hackerone vulnerable to tabnabbing Analysed #1159398 Valid Open Redirect Low 2021-07-07 – 51 Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information Analysed #1242680 Valid Information Disclosure Low 2021-06-24 – 46 "Bounty splitting enabled" can discloses if public VDPs are running private VRP Analysed #1103812 Valid No weakness recorded Low 2021-03-18 – 46 Ability to invite a new member on Sandbox Program Analysed #1088966 Valid Input Validation and Logic Low 2021-04-05 – 44 Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs Analysed #1219011 Valid Information Disclosure Low 2021-06-30 $500 41 The possibility of disrupting the normal operation of frontend using markdown Analysed #1138668 Valid Denial of Service Low 2021-08-24 – 41 Private program disclosure through notifications Analysed #1234746 Valid Access Control Low 2021-08-05 $500 39 User's who are banned from program can still be invited to the new reports as collaborators Analysed #1131306 Valid Input Validation and Logic Low 2021-09-22 – 37 Lack warning label when receiving a letter Analysed #1128701 Valid Input Validation and Logic Low 2021-05-13 – 33 Hackers can reveal the names of private programs that have an external link and Enterprise Product Edition Analysed #1130235 Valid Information Disclosure Low 2021-08-24 – 32 Reflected XSS and possible SSRF/XXE on https://events.hackerone.com/conferences/get_recording_slides_xml.xml?url=myserver/xss.xml #1028396 Valid Cross-site Scripting None 2021-03-26 – 32 Information disclosure - Feedback is accessible on Public profile even after 'disallowed' at https://hackerone.com/settings/feedback Analysed #1264725 Valid Information Disclosure Low 2021-08-03 – 30 Editing Pentest Summary Report Answers After Submitting Them Analysed #1139528 Valid Other weaknesses Low 2021-05-06 – 29 Dangling cloud instance at vpn.inverselink.com Analysed #1112679 Valid Input Validation and Logic Low 2021-03-11 $500 29 Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation #981036 Informative Input Validation and Logic Low 2021-09-20 – 29 Stored Cross-Site Scripting vulnerability in example Custom Digital Agreement Analysed #983077 Valid Cross-site Scripting Medium 2021-03-18 – 25 Mishandling of hackerone clear background checks resulting in disclosure of other hacker's information Analysed #1240162 Valid Memory Corruption Medium 2021-08-05 – 23 Tab nabbing in Hackerone inbox. Analysed #1145563 Valid Open Redirect Low 2021-08-09 $500 23 Used email confirmation link reveals the email address which is tied to it Analysed #1128358 Valid Information Disclosure None 2021-09-22 – 21 CSRF allows to test email forwarding Analysed #1131473 Valid Cross-Site Request Forgery Low 2021-05-13 – 19 Race condition allows to send multiple times feedback for the hacker Analysed #1132171 Valid Race Conditions Low 2021-09-22 – 18 PII data Leakage through hackerone reports #1256371 Valid Information Disclosure Low 2021-08-09 – 16 Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token. #1161141 Informative Information Disclosure Critical 2021-04-30 – 16 Enumerating HackerOne Pentests #1139541 Informative Misconfiguration and Insecure Design Low 2021-08-25 – 16 Hackers can reveal the names of private programs that have an external link #1127455 Informative Information Disclosure Low 2021-08-24 – 16 Bypassing the External Link Warning #1139520 Valid Open Redirect Low 2021-05-07 – 14 Temporary banned user (from platform) is able to make submissions via embedded submission forms #1133536 Valid Input Validation and Logic Low 2021-09-22 – 12 CSV injection in the credentials export #1131887 Valid Misconfiguration and Insecure Design None 2021-09-22 – 6