Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
53 of 15,219 reports · $3,600 in bounties · 161 analysed so far
- #253429ValidLinux TBB SFTP URI allows local IP disclosureTor · Information Disclosure · 2017$3,00071votes
- #282748ValidDetecting Tor Browser UI LanguageTor · Information Disclosure · 2019–64votes
- #253076ValidXSS on about:tbupdateTor · Cross-site Scripting · 2023$10043votes
- #3701692ValidMalicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After TeardownTor · Denial of Service · 2026 · Low$10035votes
- #3709605ValidConflux-queued zero-length RELAY_END triggers heap out-of-bounds readTor · Memory Corruption · 2026 · Medium–33votes
- #1880610ValidSnowflake server: Leak of TLS packets from other clientsTor · Information Disclosure · 2023–30votes
- #252580ValidScrollbar Width permits detecting browser platformTor · Information Disclosure · 2017–29votes
- #3709703ValidTor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cacheTor · Denial of Service · 2026 · Low–28votes
- #376004InformativePotential IP revealing using UNC Path in Windows File PickerTor · Information Disclosure · 2023–25votes
- #269347InformativeSQL Injection in parameter REPORTTor · SQL Injection · 2023–23votes
- #294364ValidDe-anonymization by visiting specially crafted bookmark.Tor · Information Disclosure · 2018–15votes
- #258630ValidAccess to local file system using javascriptTor · Misconfiguration and Insecure Design · 2017–15votes
- #275960InformativeAddress Bar Spoofing on TOR BrowserTor · Input Validation and Logic · 2023–14votes
- #263663InformativeZip bombTor · Memory Corruption · 2023–14votes
- #252626Informative[Android org.torproject.android] Possible to force list of bridgesTor · Access Control · 2017–13votes
- #588239ValidDetect Tor Browser's languageTor · Information Disclosure · 2019–11votes
- #410087InformativeExpose user IP if TOR crashsTor · No weakness recorded · 2018–11votes
- #274998InformativeUse of unitialized value in crypto_pk_num_bits (src/common/crypto.c:971)Tor · Memory Corruption · 2023–11votes
- #273377N/AMultiple Path Transversal VulnerabilitesTor · File and Path Handling · 2023–11votes
- #142773Valid16 instances where return value of OpenSSL i2d_RSAPublicKey is discarded -- might lead to use of uninitialized memoryTor · Information Disclosure · 2017–11votes
- #257942Validlanguagechange event fires simultaneously on all tabsTor · Information Disclosure · 2017$10010votes
- #256647ValidSimple CSS line-height identifies platformTor · Information Disclosure · 2017–10votes
- #126797InformativeUse-after-free during XML transformations (MFSA-2016-27)Tor · Memory Corruption · 2017$30010votes
- #269243InformativeReport Regarding Security VulnerabilityTor · No weakness recorded · 2023–9votes
- #268320Informativesolving TOR vulnerability, in other to make bruteforce difficultTor · Memory Corruption · 2023–9votes
- #265706Informative[rt.torproject.org] No Rate Limitting on Login FormTor · Authentication · 2023–9votes
- #115686Valid[tor] pre-emptive defenses, potential vulnerabilitiesTor · Misconfiguration and Insecure Design · 2017–8votes
- #330721InformativeExpose relay IP in the debug (The source is different from the rendering)Tor · No weakness recorded · 2018–7votes
- #115702Valid[tor] libevent dns OOB readTor · Memory Corruption · 2017–7votes
- #113424Valid[tor] control connection pre-auth DoS (infinite loop) with --enable-buffereventsTor · Denial of Service · 2017 · no account (title)–7votes
- #273819InformativeContent spoofing onTor · Misconfiguration and Insecure Design · 2023–6votes
- #163459Validpotential memory corruption in or/buffers.c (particularly on 32 bit)Tor · Memory Corruption · 2017–6votes
- #138025ValidHeap corruption via memarea.cTor · Memory Corruption · 2017–6votes
- #126598ValidOverreads/overcopies in torsocksTor · Memory Corruption · 2017–6votes
- #112784Validlibevent (stack) buffer overflow in evutil_parse_sockaddr_portTor · Memory Corruption · 2017–6votes
- #112632Valid[tor] libevent dns remote stack overread vulnerabilityTor · Memory Corruption · 2017–6votes
- #112386Validsmartlist_add, smartlist_insert (may) cause heap corruption as a result of inadequate checks in smartlist_ensure_capacityTor · Memory Corruption · 2017–6votes
- #274285N/Ahttps://get.ooni.torproject.org/Tor · No weakness recorded · 2023–5votes
- #269426InformativeTor Project - Full Path DisclosureTor · Information Disclosure · 2023–5votes
- #1250273InformativeTor Browser using --log or --verbose logs the exact connection time a client connects to any v2 domains.Tor · Information Disclosure · 2021–4votes
- #1316412N/AInformation Exposure Through Directory ListingTor · Information Disclosure · 2021–3votes
- #423336N/AEmail Spoofing Possible on torproject.org Email DomainTor · Input Validation and Logic · 2018–3votes
- #281597InformativePreferred language option fingerprinting issue in Tor BrowserTor · Information Disclosure · 2017–3votes
- #276255DuplicateUse of unitialized value in token_check_object (src/or/parsecommon.c:224)Tor · Memory Corruption · 2019–3votes
- #276253InformativeUse of uninitialized value in networkstatus_parse_vote_from_string (src/or/routerparse.c:3533)Tor · Memory Corruption · 2017–2votes
- #280282N/AEnforce minimum master password complexityTor · Authentication · 2017–1votes
- #274997InformativeUse of uninitialized value in memarea_strdup (src/common/memarea.c:369)Tor · Memory Corruption · 2017–1votes
- #268113InformativeUncloaking hidden services and hidden service usersTor · Cryptography · 2017–1votes
- #264481InformativeStack overflow in UnbindFromTree (browser can be crashed remotely)Tor · Memory Corruption · 2017–1votes
- #358005InformativeTor Browser: iframe with `data:` uri has access to parent windowTor · No weakness recorded · 2018–0votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.