Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
10 of 15,219 reports · 227 analysed so far
- #330105ValidExploitable vulnerability in SDEXStellar.org · Input Validation and Logic · 2018–29votes
- #342977Informativebrute force attack allowed on admin page https://www.stellar.org/wp-admin/Stellar.org · Authentication · 2020–16votes
- #321511ValidIt's possible to put SDX orderbook into invalid state and execute trades at arbitrary priceStellar.org · Input Validation and Logic · 2018–12votes
- #263780InformativeDirect URL access to PDF filesStellar.org · Access Control · 2020–10votes
- #242874InformativeBypassing Verify Humans PageStellar.org · Authentication · 2020–8votes
- #240659Validheap-buffer-overflow (READ of size 1) in cpptoml::parser::consume_whitespace()Stellar.org · Memory Corruption · 2017–8votes
- #239479N/AHTTP - Basic Authentication on https://www.stellar.org/wp-login.phpStellar.org · Misconfiguration and Insecure Design · 2017–7votes
- #281387InformativexssStellar.org · No weakness recorded · 2020–6votes
- #239380InformativeSession Cookie without HttpOnly and secure flag setStellar.org · Misconfiguration and Insecure Design · 2017–4votes
- #376563N/AAdmin panel of https://www.stellar.org/wp-admin/Stellar.org · Misconfiguration and Insecure Design · 2020–3votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.