Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Potential IP revealing using UNC Path in Windows File Picker#376004 | Informative | Information Disclosure | Low | 2023-11-28 | – | 25 |
| SQL Injection in parameter REPORT#269347 | Informative | SQL Injection | Medium | 2023-11-28 | – | 23 |
| Address Bar Spoofing on TOR Browser#275960 | Informative | Input Validation and Logic | High | 2023-01-02 | – | 14 |
| Zip bomb#263663 | Informative | Memory Corruption | Critical | 2023-11-28 | – | 14 |
| [Android org.torproject.android] Possible to force list of bridges#252626 | Informative | Access Control | High | 2017-08-21 | – | 13 |
| Expose user IP if TOR crashs#410087 | Informative | No weakness recorded | – | 2018-09-21 | – | 11 |
| Use of unitialized value in crypto_pk_num_bits (src/common/crypto.c:971)#274998 | Informative | Memory Corruption | – | 2023-11-28 | – | 11 |
| Use-after-free during XML transformations (MFSA-2016-27)#126797 | Informative | Memory Corruption | – | 2017-10-21 | $300 | 10 |
| Report Regarding Security Vulnerability#269243 | Informative | No weakness recorded | – | 2023-11-28 | – | 9 |
| solving TOR vulnerability, in other to make bruteforce difficult#268320 | Informative | Memory Corruption | Low | 2023-11-28 | – | 9 |
| [rt.torproject.org] No Rate Limitting on Login Form#265706 | Informative | Authentication | – | 2023-11-28 | – | 9 |
| Expose relay IP in the debug (The source is different from the rendering)#330721 | Informative | No weakness recorded | – | 2018-07-21 | – | 7 |
| Content spoofing on#273819 | Informative | Misconfiguration and Insecure Design | Low | 2023-11-28 | – | 6 |
| Tor Project - Full Path Disclosure#269426 | Informative | Information Disclosure | Low | 2023-11-28 | – | 5 |
| Tor Browser using --log or --verbose logs the exact connection time a client connects to any v2 domains.#1250273 | Informative | Information Disclosure | High | 2021-09-27 | – | 4 |
| Preferred language option fingerprinting issue in Tor Browser#281597 | Informative | Information Disclosure | Low | 2017-10-24 | – | 3 |
| Use of uninitialized value in networkstatus_parse_vote_from_string (src/or/routerparse.c:3533)#276253 | Informative | Memory Corruption | None | 2017-10-31 | – | 2 |
| Use of uninitialized value in memarea_strdup (src/common/memarea.c:369)#274997 | Informative | Memory Corruption | – | 2017-10-25 | – | 1 |
| Uncloaking hidden services and hidden service users#268113 | Informative | Cryptography | – | 2017-10-20 | – | 1 |
| Stack overflow in UnbindFromTree (browser can be crashed remotely)#264481 | Informative | Memory Corruption | High | 2017-10-02 | – | 1 |
| Tor Browser: iframe with `data:` uri has access to parent window#358005 | Informative | No weakness recorded | High | 2018-06-06 | – | – |
| Cross-domain linkability when system time changed in Tor Browser#282339 | Informative | Information Disclosure | Low | 2017-10-26 | – | – |
| Crashes/Buffer at 0x2C0086,name=PBrowser::Msg_Destroy#281682 | Informative | Memory Corruption | Medium | 2017-10-24 | – | – |
| Sql query disclosure,#267922 | Informative | Information Disclosure | Low | 2017-09-18 | – | – |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.