Server Side Request Forgery (SSRF) via Analytics Reports Analysed #2262382 Valid Server-Side Request Forgery Critical 2023-12-08 $25,000 529 An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name Analysed #2032716 Valid Information Disclosure High 2023-07-04 $12,500 429 IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query Analysed #2122671 Valid Insecure Direct Object Reference High 2023-08-29 – 395 [CVE-2022-44268] Arbitrary Remote Leak via ImageMagick Analysed #1858574 Valid File and Path Handling Critical 2023-03-16 – 371 Insecure Direct Object Reference (IDOR) - Delete Campaigns Analysed #1969141 Valid Insecure Direct Object Reference High 2023-05-03 – 346 Google Docs link in JS files allows editing & reading survey information Analysed #2180521 Valid Information Disclosure Medium 2023-11-04 – 217 IDOR vulnerability in unreleased HackerOne Copilot feature Analysed #2218334 Valid Insecure Direct Object Reference Medium 2023-10-25 – 210 adding h1_analyst_* to username for normal users Analysed #1770797 Valid Input Validation and Logic Low 2023-04-12 $500 187 RXSS at image.hackerone.live via the `url` parameter Analysed #2035332 Valid Cross-site Scripting Low 2023-08-11 $500 171 Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone Analysed #1727221 Valid Cross-Site Request Forgery High 2023-06-19 – 168 Takeover of hackerone.engineering via Github Analysed #2085260 Valid Access Control Medium 2023-07-31 – 135 Stored XSS on www.hackerone.com due to deleted S3-bucket from old page_widget Analysed #1598347 Valid Cross-site Scripting Medium 2023-03-10 – 122 Banned user still able to invited to reports as a collabrator and reset the password Analysed #1959219 Valid Access Control Medium 2023-07-06 – 107 How the Arch Angel stole Live Events Analysed #2285198 Valid No weakness recorded None 2023-12-15 – 98 Bypass report submit restriction/ban using the API key Analysed #2081930 Valid Access Control Medium 2023-10-29 – 91 SQL Injection in CVE Discovery Search Analysed #1893800 Valid SQL Injection High 2023-03-06 – 87 Scope information is leaked when visiting policy scopes tab of any External Program Analysed #1868473 Valid Access Control Medium 2023-03-10 – 86 Triager/Team members can edit hacker's report and hacker is not even notified Analysed #2061367 Valid No weakness recorded Medium 2023-08-31 $2,500 84 Draft report exposure via slack alerting system for programs Analysed #2069593 Valid Information Disclosure Medium 2023-10-06 – 83 Bypass of #2035332 RXSS at image.hackerone.live via the `url` parameter Analysed #2106708 Valid Cross-site Scripting Low 2023-08-22 – 80 Any one can view collaborater email address via path /reports/<id>/participants Analysed #1918362 Valid Access Control Low 2023-06-01 – 78 HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity Analysed #1826141 Valid Information Disclosure Low 2023-02-10 $500 78 Asset Inventory Internal Descriptions are leaked in CSV export Analysed #2011431 Valid Input Validation and Logic Medium 2023-07-12 – 76 Usernames still visible on report export pdf despite "I want to redact all usernames" is selected Analysed #2054222 Valid Information Disclosure Low 2023-08-08 $500 75 Race condition in joining CTF group Analysed #1540969 Valid Race Conditions Low 2023-01-08 $500 72 Private program name disclosure in the invitation mail for another program Analysed #2228413 Valid Information Disclosure Low 2023-12-08 – 58 Organization members can delete reports in teams they have no access to Analysed #2203432 Valid Access Control Medium 2023-11-22 – 57 Register & create a ticket as somebody else on HackerOne Support Analysed #2082680 Valid Misconfiguration and Insecure Design None 2023-07-31 – 56 New Search Feature: Search for non-public words in limited disclosure reports Analysed #2213251 Valid Information Disclosure Medium 2023-10-25 – 55 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports. Analysed #2000000 Valid Misconfiguration and Insecure Design Low 2023-07-11 – 54 Hacker email disclosed on submission at hackerone hactivity Analysed #2215434 Valid Information Disclosure Low 2023-10-24 $100 53 Staff and Triage can modify the initial post of a report, including of already disclosed reports Analysed #2096271 Valid Access Control Medium 2023-08-28 – 50 Program managers can see draft reports using Export Reports feature Analysed #1664920 Valid Input Validation and Logic Low 2023-05-18 – 50 Attachment in published HackerOne report exposure private program Analysed #1869613 Valid Information Disclosure Low 2023-06-07 – 49 information disclosure of another company bug on video. Analysed #1886143 Valid Information Disclosure Low 2023-03-12 – 47 Hackers two email disclosed on submission at hackerone hactivity Analysed #2134874 Valid Information Disclosure – 2023-10-18 – 43 HTML injection in email at https://www.hackerone.com/ Analysed #1374017 Valid Command and Code Injection Low 2023-05-12 – 40 Internal machine learning API endpoint for CWE classification is vulnerable to path traversal Analysed #2032778 Valid File and Path Handling Medium 2023-07-05 – 33 Private information exposed through GraphQL search endpoints aggregates Analysed #1838329 Valid Information Disclosure Medium 2023-01-19 – 32 HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension Analysed #1874260 Valid Cross-site Scripting Low 2023-02-14 – 21 Users querying dim_hacker_reports table through Analytics API can determine data from dim_reports table using WHERE or HAVING query Analysed #1824342 Valid Information Disclosure Medium 2023-02-22 – 21 Names not completely redacted despite "Redact the names of the involved users" is selected #2122644 Valid Information Disclosure Low 2023-08-29 $500 18