Public HackerOne bug reports.

Show All Bugs

Team Bounty Title
Unikrn $200 HTML injection in email in unikrn.com
Rockstar Games $500 dom based xss in http://www.rockstargames.com/GTAOnline/ (Fix bypass)
Legal Robot $20 No length limit in invite_code can cause server degradation
Legal Robot $20 CSP script-src includes "unsafe-inline"
Legal Robot $20 Improper validation of parameters while creating issues
Legal Robot $100 Update any profile
Legal Robot $20 first name and last name restrictions bypass
Legal Robot $20 TabNabbing issue (due to taget=_blank)
Legal Robot $20 Incorrect error message
Legal Robot $20 Incorrect email content when disabling 2FA
Legal Robot $20 Lengthy manual entry of 2FA secret
Trello $128 A CRLF injection into the redirect URL of https://trello.com/1/authorize can be used to cause a denial of service when later redirected to
Quora $500 [Quora Android] Possible to steal arbitrary files from mobile device
Snapchat $5,000 RCE/LFI on test Jenkins instance due to improper authentication flow
Legal Robot $40 Code injection
Legal Robot $20 User enumeration from failed login error message
Brave Software $200 URL Spoof / Brave Shield Bypass
Legal Robot $20 Change password logic inversion
Legal Robot $20 Profile fields validation bypass
Legal Robot $20 Profile shows incorrect account creation date
Rockstar Games $500 dom based xss in https://www.rockstargames.com/GTAOnline/
Bitvise $100 The POODLE attack (SSLv3 supported)
Unikrn $50 Escaping images directory in S3 bucket when saving new avatar, using Path Traversal in filename
Boozt Fashion AB $60 Password reset token issue
Legal Robot $20 [Cross-domain Referer leakage] Password reset token leakage via referer
Automattic $225 XSS Vulnerability in WooCommerce Product Vendors plugin
Rockstar Games $600 CSRF Vulnerability allows attackers to steal SocialClub private token.
Legal Robot $20 Token leakage by referrer header & analytics
Zomato $500 Restaurant payment information leakage
Unikrn $40 Flash CSRF: Update Ad Frequency %: [cp-ng.pinion.gg]
Zomato $100 Length extension attack leading to HTML injection
Legal Robot $20 No notification on change password feature
Legal Robot $20 Meta characters are not filtered into full name on profile page
Legal Robot $20 Pages don't render in old browsers like IE11
Legal Robot $60 Missing Issuer parameter on TOTP 2FA
Moneybird $50 Stored XSS at Moneybird
Legal Robot $20 [New Feature] Password history check
TTS Bug Bounty $150 The Federalsit session cookie (federalist.sid) is not properly invalidated - backdoor access to the account is possible
Legal Robot $20 User enumeration
Legal Robot $20 Password complexity ignores empty spaces
Legal Robot $60 Users with 2FA can have multiple sessions
Legal Robot $20 Account profile shows encryption recovery box for all users
Legal Robot $60 Enhancement: email confirmation for 2FA recovery
Legal Robot $20 Intercom chat session information persists after logout
Legal Robot $60 2FA Error Handling on Google Authenticator
Legal Robot $90 2FA user enumeration via password reset
Legal Robot $40 Password complexity not evenly enforced
Legal Robot $90 Missing link to 2FA recovery code
Legal Robot $90 Missing link to TOTP manual enroll option
Legal Robot $60 Non-functional 2FA recovery codes
TTS Bug Bounty $150 Race condition on the Federalist API endpoints can lead to the Denial of Service attack
Zomato $50 Posting to Twitter CSRF on php/post_twitter_authenticate.php
Grabtaxi Holdings Pte Ltd $1,000 Git repository found
Twitter $10,080 XXE on sms-be-vip.twitter.com in SXMP Processor
Coinbase $100 Information disclosure same issue #176002
Grabtaxi Holdings Pte Ltd $200 [parcel.grab.com] DOM XSS at /assets/bower_components/lodash/perf/
HackerOne $1,500 Reading redacted data via hackbot's answers
Grabtaxi Holdings Pte Ltd $200 Dom based xss affecting all pages from https://www.grab.com/.
Zomato $250 Bypass OTP verification when placing Order
VK.com $100 Узнать название частной группы и ее аватарку по видеоролику.
Zomato $500 [█████████] Hardcoded credentials in Android App
Twitter $420 Open Redirect
Snapchat $250 [spectacles.com] Bypassing quantity limit in orders
Coinbase $100 Captcha Bypass in Coinbase SignUp Form
Rockstar Games $500 Reflected XSS via Double Encoding
Zomato $300 SQL Injection, exploitable in boolean mode
TTS Bug Bounty $350 [IDOR] The authenticated user can restart website build or view build logs on any another Federalist account
TTS Bug Bounty $300 The user, who was deleted from Github Organization, still can access all functions of federalist, in case he didn't do logout
Zomato $1,000 Login to any account with the emailaddress
TTS Bug Bounty $300 Double Stored Cross-Site scripting in the admin panel
shopify-scripts $800 Use after free in mruby-mpdecimal
Apache httpd (IBB) $1,500 Apache HTTP Request Parsing Whitespace Defects CVE-2016-8743
Shopify $500 IDOR [partners.shopify.com] - User with ONLY Manage apps permission is able to get shops info and staff names from inside the shop
RubyGems $1,000 Installing a crafted gem package may create or overwrite files CVE-2017-0901
Rockstar Games $1,000 XSS in http://www.rockstargames.com/theballadofgaytony/js/jquery.base.js
VK.com $100 Нет маркера на добавление песни в плейлист пользователя
shopify-scripts $800 Null pointer dereference with send/method_missing
Maximum $50 Open redirect on https://werkenbijdefensie.nl/
Pornhub $500 Stored XSS in the any user profile using website link
Apache httpd (IBB) $1,500 ap_find_token() Buffer Overread CVE-2017-7668
Starbucks $2,000 Possible subdomain takeover at openapi.starbucks.com
Rockstar Games $500 flash injection in http://www.rockstargames.com/IV/imgPlayer/imageEmbed.swf
Python (IBB) $500 Unsafe arithmetic in PyString_DecodeEscape
Pornhub $750 pornhub.com/user/welcome/basicinfo nickname field is vulnerable on xss
Shopify $500 Stored XSS in *.myshopify.com
Maximum $350 Open Redirect & Information Disclosure [mijn.werkenbijdefensie.nl]
Mail.Ru $100 BruteForce Any [My.com] Account Credentials.
Automattic $800 SSRF and local file disclosure in https://wordpress.com/media/videos/ via FFmpeg HLS processing
Snapchat $500 CRLF Injection at vpn.bitstrips.com
MapsMarker.com e.U. $20 Cross-site Scripting (XSS) in /updates-pro/archive/
ToyTalk $200 Host Header Injection and Cache Poisoning
Perl (IBB) $500 heap-buffer-overflow (READ of size 61) in Perl_re_intuit_start()
Rockstar Games $250 Control characters incorrectly handled on Crew Status Update
Keybase $500 Universal Cross-Site Scripting in Keybase Chrome extension
Shopify $5,000 XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications
Perl (IBB) $500 heap-buffer-overflow (READ of size 11) in Perl 5.25.x
Snapchat $15,000 Open prod Jenkins instance
Rockstar Games $1,000 Stored XSS in profile activity feed messages
Rockstar Games $1,000 Stored XSS in snapmatic comments
Shopify $3,000 XSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog"
VK.com $100 CSRF на сброс ключа трансляции.
Legal Robot $20 Domain takeover (legalrobot.co.za)
WordPress $275 DOM Based XSS In mercantile.wordpress.org
WordPress $275 Stored self-XSS in mercantile.wordpress.org checkout
Mail.Ru $150 XSS в портальной навигации
HackerOne $10,000 WannaCrypt “Killswitch”
Mail.Ru $500 Xss в https://e.mail.ru/
Pornhub $250 Partial disclosure of Private Videos through data-mediabook attribute information leak
Discourse $256 Any authenticated user can download full list of users, including email
Discourse $64 SSRF in upload IMG through URL
Paragon Initiative Enterprises $50 Directory Disclose,Email Disclose Zendmail vulnerability
Maximum $50 Cross-site Scripting (XSS) on [maximum.nl]
Trello $256 Cross-Site Scripting on Trello's iPhone App
Instacart $150 Reverse Tab-nabbing at www.instacart.com/store/partner_recipe?recipe_url=
Instacart $100 XSS at in instacart.com/store/partner_recipe
shopify-scripts $100 Heap Overflow in fiber_switch triggered from Fiber.transfer
Dashlane $100 [https://www.dashlane.com] Test Panel Disclosure
Maximum $300 IDOR in editing courses
Mail.Ru $500 Xss в https://e.mail.ru/
Harvest $300 [platform.harvestapp.com] Reflected XSS in Error Message via URL parameters
Ubiquiti Networks $100 HTML Injection on airlink.ubnt.com
VK.com $1,000 local file disclosure via FFmpeg hls processing
Shopify $2,000 Reflected XSS in <any>.myshopify.com through theme preview
HackerOne $500 HackerOne reports escalation to JIRA is CSRF vulnerable
RubyGems $500 Escape sequence injection in "summary" field CVE-2017-0899
Paragon Initiative Enterprises $50 Cross-site-Scripting
shopify-scripts $200 OP_SCALL in LHS of a OP_ASGN resulting in arbitrary memory write
HackerOne $1,000 Changing Victim's JIRA Integration Settings Through Multiple Bugs
Dashlane $350 Throttling Bypass - ws1.dashlane.com
Dashlane $300 Extract Billing admin email address using random team id
Mapbox $300 Node modules path disclosure due to lack of error handling
Uber $2,000 phone number exposure for riders/drivers given email/uuid
VK.com $100 Посмотреть видеоролики, которые пользователь когда-либо скидывал в ЛС.
Uber $8,500 SAML Authentication Bypass on uchat.uberinternal.com
Phabricator $300 IRC-Bot exposes information
Mapbox $500 Open Aws Amazon S3 Buckets
Pornhub $350 Mixed Reflected-Stored XSS on pornhub.com (without user interaction) in the playlist playing section
shopify-scripts $800 heap-use-after-free in mrb_vm_exec - vm.c:1247
ICQ $1,000 Дубликат: https://hackerone.com/reports/219171 (доступ к аккаунту, через сброс пароля)
WordPress $150 Stored but [SELF] XSS in mercantile.wordpress.org
shopify-scripts $100 heap use after free in fiber_switch
WordPress $387.50 Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter
The Internet $500 Mercurial can be tricked into granting authorized users access to the Python debugger CVE-2017-9462
Trello $128 Malicious file can be hidden as Card Attachment or Card Cover image
WordPress $275 XSS in the search bar of mercantile.wordpress.org
YouPorn $250 DOM-based XSS on youporn.com (main page)
OpenSSL (IBB) $500 Excessive allocation of memory in dtls1_preprocess_fragment() (CVE-2016-6308) CVE-2016-6308
OpenSSL (IBB) $500 Excessive allocation of memory in tls_get_message_header() (CVE-2016-6307) CVE-2016-6307
OpenSSL (IBB) $500 Certificate message OOB reads (CVE-2016-6306) CVE-2016-6306
OpenSSL (IBB) $500 OOB read in TS_OBJ_print_bio() (CVE-2016-2180) CVE-2016-2180
OpenSSL (IBB) $500 OOB write in BN_bn2dec() (CVE-2016-2182) CVE-2016-2182
OpenSSL (IBB) $500 Malformed SHA512 ticket DoS (CVE-2016-6302) CVE-2016-6302
OpenSSL (IBB) $500 OOB write in MDC2_Update() (CVE-2016-6303) CVE-2016-6303
ok.ru $300 Blind SQL Injection
shopify-scripts $800 Null pointer dereferences in kh_copy_mt
Twitter $560 HTTP 401 response injection on "amp.twimg.com/amplify-web-player/prod/source.html" through "image_src" parameter
shopify-scripts $800 heap-buffer-overflow (read outside of buffer) in mrb_vm_exec()
Open-Xchange $200 Critical : View/Edit access to private appointments of calendar folder by read only user (Vertical privilege escalation)
Open-Xchange $200 Unauthorized access to attachments details of Private Calendar appointments (Access control issue)
Mavenlink $50 Tabnabbing via Window.Opener @Mavenlink
Ubiquiti Networks $100 Expired SSL certificate
Algolia $200 [GitHub Extension] Unsanitised HTML leading to XSS on GitHub.com
HackerOne $750 Race condition leads to duplicate payouts
HackerOne $500 Subdomain takeover #4 at info.hacker.one
shopify-scripts $100 mirb only: stack-buffer-overflow (OOB write) in main()
Maximum $25 XSS
VK.com $100 api.vk.com отдаёт в ответ HTML авторизированную страницу vk.com
Dovecot $600 Dovecot authentication is vulnerable to timing attacks.
shopify-scripts $100 Invalid Pointer reference in L_RESCUE
Harvest $400 Client can redirect payment, causing payment discrepancy between Harvest and PayPal
Uber $5,000 Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com
Twitter $280 [██████████.gnip.com] .htpasswd disclosure
Open-Xchange $200 Resend invitation to members by Read only user(Privilege Escalation)
VK.com $2,000 Возможность взлома любого пользователя, не использующего двухфакторной аутентификации, через получения кода восстановления на чужой номер.
Ubiquiti Networks $150 XSS
Ubiquiti Networks $500 [dev-unifi-go.ubnt.com] Insecure CORS, Stealing Cookies
shopify-scripts $100 SIGABRT in sym_validate_len - symbol.c:44
Coinbase $100 [buy.coinbase.com]Content Injection
shopify-scripts $800 Invalid pointer dereference in OP_ENTER
shopify-scripts $800 SIGSEGV in array_copy - array.c:71
Twitter $560 [Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME
Kaspersky Lab $400 In App purchase Hack
Automattic $500 An Automattic employee's GitHub personal access token exposed in Travis CI build logs
shopify-scripts $800 Null pointer dereference in OP_ENTER
Starbucks $500 Stored XSS in comments on https://www.starbucks.co.uk/blog/*
RubyGems $1,000 Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier CVE-2017-0902
Shopify $1,000 XSS in $shop$.myshopify.com/admin/ via twine template injection in "Shopify.API.Modal.input" method when using a malicious app
Shopify $800 XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious app
shopify-scripts $800 kh_put_iv SEGFAULT - mruby 1.2.0
Maximum $300 Possible to view and takeover other user's education and courses @ mijn.werkenbijdefensie.nl
Maximum $150 Possible to unsubscribe from activities using CSRF @ mijn.werkenbijdefensie.nl
HackerOne $1,000 Subdomain takeover #3 at info.hacker.one
shopify-scripts $100 SIGSEGV in mrb_vm_exec
shopify-scripts $800 SIGSEGV in mrb_str_inum
Mail.Ru $750 Stored XSS in e.mail.ru (payload affect multiple users)
shopify-scripts $800 Heap Buffer Overflow in mrb_hash_keys
OpenSSL (IBB) $2,500 OCSP Status Request extension unbounded memory growth (CVE-2016-6304)
Nextcloud $450 Reflected XSS in error pages (NC-SA-2017-008) CVE-2017-0891
Pornhub $250 Reflected XSS in login redirection module
Phabricator $750 Phabricator is vulnerable to padding oracle attacks and chosen-ciphertext attacks.
shopify-scripts $800 SIGABRT - in free
shopify-scripts $800 heap use-after-free in mrb_vm_exec()
shopify-scripts $800 Crash in ary_concat()
Shopify $500 Full access at an internal service of Shopify
Pornhub $500 Blind Stored XSS against Pornhub employees using Amateur Model Program
shopify-scripts $800 Null pointer dereferences in mrb_get_args
shopify-scripts $800 SIGABRT in mrb_debug_info_append_file
shopify-scripts $800 Null pointer dereference in mrb_class
shopify-scripts $300 Garbage collector crash
HackerOne $2,000 A HackerOne employee's GitHub personal access token exposed in Travis CI build logs
shopify-scripts $800 SIGSEGV in mrb_class
ownCloud $150 HTML Injection in Owncloud
Twitter $2,520 CSRF on Periscope Web OAuth authorization endpoint
VK.com $200 Подмена SSL-сертификата для любой группы в секции Управление группой->Работа с API неавторизированным пользователем.
Ubiquiti Networks $6,000 Ability to log in as any user without authentication if █████████ is empty
Brave Software $100 [iOS] URL can be replaceState by blob URL in iOS Brave
shopify-scripts $800 SIGSEGV in mrb_vm_exec
HackerOne $500 Report invitation links not restricted to any existing user
Rockstar Games $350 Profile bio at rockstar is accepting control characters
shopify-scripts $800 Null pointer dereference in ary_concat
Shopify $500 Stored passive XSS at scheduled posts (kitcrm.com)
shopify-scripts $100 SIGABRT - mirb - Double Free
Rockstar Games $350 Login form on non-HTTPS page
Trello $768 Rate limiting of incorrect Two Factor Authentication codes not enforced
shopify-scripts $800 Null pointer dereferences in ary_concat
Yelp $100 Clickjacking Vulnerability found on Yelp
Shopify $1,500 Stored XSS in [shop].myshopify.com/admin/orders/[id]
Discourse $512 Admin Command Injection via username in user_archive ExportCsvFile
BrickFTP $600 File access controls incorrectly enforced for files shared via QuickLink - Unshared files can be accessed
shopify-scripts $800 SIGABRT - mirb and mruby
Phabricator $600 Differential "Show Raw File" feature exposes generated files to unauthorised users
Legal Robot $60 Token leakage by referrer
shopify-scripts $800 SIGSEGV - mrb_obj_value
Discourse $512 Arbitrary Local-File Read from Admin - Restore From Backup due to Symlinks
shopify-scripts $800 Use-after-free leading to an invalid pointer dereference
shopify-scripts $100 SIGSEGV in str_buf_cat
Nextcloud $250 DOM XSS vulnerability in search dialogue (NC-SA-2017-007) CVE-2017-0890
Legal Robot $40 Password reset form ignores email field
shopify-scripts $800 SIGABRT in only mirb
HackerOne $750 IE 11 Self-XSS on Jira Integration Preview Base Link
Imgur $5,000 RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`
shopify-scripts $800 SIGSEGV - kh_get_n2s - in /src/symbol.c:37
shopify-scripts $100 sprintf gem - format string combined attack
shopify-scripts $800 Null pointer dereference in mrb_class
shopify-scripts $800 SIGSEGV - mrb_yield_with_class
Algolia $100 An “algobot”-s GitHub access token was leaked
Moneybird $50 Stored Cross Site Scripting in Customer Name
Shopify $500 Stealing users' facebook access tokens - kitcrm.com
Rockstar Games $150 Source Code Disclosure (CGI)
Gratipay $1 Inadequate/dangerous jQuery behavior
VK.com $200 Написать от имени любого пользователя на его стене, если он перейдет по ссылке. https://vk.com/al_video.php
shopify-scripts $800 Null pointer dereference in 'get_file'
Rockstar Games $350 Control Character Injection In Messages
LocalTapiola $100 XSS on 3rd party service Localtapiola is using
Rockstar Games $300 use of unsafe host header leads to open redirect
shopify-scripts $800 Null pointer dereferences from mrb_vm_exec
Slack $850 Bypass to postMessage origin validation via FTP
Rockstar Games $150 Full path Disclosure in Rockstargames.com/img/global/
shopify-scripts $800 mrb_vm_exec - null ptr dereference
Rockstar Games $150 SSLv3 POODLE Vulnerability
shopify-scripts $800 Invalid Pointer Reference from OP_RESCUE
HackerOne $500 Transitioning a Private Program to Public Does Not Clear Previously Private Updates to Hackers
shopify-scripts $800 SIGSEGV - mark_context_stack
HackerOne $100 javascript: and mailto: links are allowed in JIRA integration settings
shopify-scripts $800 Heap buffer overflow in mruby value_move
Starbucks $250 DOM XSS on teavana.com via "pr_zip_location" parameter
shopify-scripts $800 Heap buffer overflow with long array assignment
LocalTapiola $264 HTML Injection in email from http://www.lahitapiola.fi/henkilo/sivut/tonttutesti
Ruby $500 public report - Reproducible - Writable RubyCi Amazon s3 bucket[207053]
Ruby $500 Open S3 Bucket WriteAble To Any Aws User
HackerOne $1,000 Subdomain takeover #2 at info.hacker.one
Twitter $7,560 [URGENT] Opportunity to publish tweets on any twitters account
BrickFTP $100 CSRF @ configuration
Udemy $50 Subdomain Takeover at Landing.udemy.com
VK.com $100 Обход: "Аудиозапись недоступна для прослушивания в Вашем регионе."
Ubiquiti Networks $100 Reflected cross-site scripting (XSS) vulnerability in scores.ubnt.com allows attackers to inject arbitrary web script via p parameter.
shopify-scripts $800 Null pointer dereference in mark_context_stack
Lyst $100 Site configured improperly at subdomain of lyst.co.uk
shopify-scripts $100 Memory corrouption in mrb_gc_mark
LocalTapiola $200 Brute force unsubscription on /webApp/unsub_sb (viestinta.lahitapiola.fi)
LocalTapiola $50 /icons/README is still available on viestinta.lahitapiola.fi
Perl (IBB) $1,000 read outside of buffer (heap buffer overflow) in S_regmatch - regexec.c:6057
Pornhub $50 http://ht.pornhub.com/ stored XSS in widget stylesheet
shopify-scripts $800 Heap use-after-free in mrb_vm_exec
Ubiquiti Networks $1,000 sqli
Shopify $500 Subdomain takeover on s3.shopify.com
Lyst $100 Mixed Active content issue on https://www.lyst.com
shopify-scripts $100 Controlled address leak due to type confusion - ASLR bypass
HackerOne $750 Information leakage via CSV when content is valid JavaScript
Slack $3,000 Stealing xoxs-tokens using weak postMessage / call-popup redirect to current team domain
Ruby $500 Writable RubyCi Amazon s3 bucket
HackerOne $1,500 Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP
Uber $2,500 SQL injection in 3rd party software Anomali
Robinhood $100 Open Redirect located at https://www.robinhood.com/oauth2/authorize/?
YouPorn $100 XSS via login cookie
Starbucks $750 Persistent CSRF in /GiftCert-AddToBasket prevents purchases on eCommerce sites
shopify-scripts $800 Heap Buffer Overflow while processing OP_SEND
Imgur $2,500 Remote Code Execution on Git.imgur-dev.com
shopify-scripts $800 mruby heap use-after-free
LocalTapiola $50 show control page if you insert ' at http://viestinta.lahitapiola.fi/
shopify-scripts $100 Interger overflow in str_substr leading to read/write out of bound memory
shopify-scripts $800 Use After Free in mrb_vm_exec
shopify-scripts $800 Heap Buffer overflow in mrb_ary_unshift
shopify-scripts $100 SIGABRT - method_missing - mark_context_stack
Zopim $50 express config leaking stacktrace
Uber $1,500 pam-ussh may be tricked into using another logged in user's ssh-agent
shopify-scripts $800 A crash when an exception is caught in a caller and the receiver returned from `ensure`
shopify-scripts $100 segafult in mruby's sprintf - mrb_str_format
WordPress $350 Infrastructure - Photon - SSRF
shopify-scripts $800 Heap buffer oveflow with many arguments
Rockstar Games $1,400 <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->
LocalTapiola $315 High server resource usage on captcha (viestinta.lahitapiola.fi)
shopify-scripts $1,000 Segmentation fault while printing backtrace
YouPorn $250 Reflected XSS in Meta Tag
YouPorn $2,500 Time Based SQL-inject in post-parametr login[username] [domain - youporn.com]
Greenhouse.io $100 Open Redirect in <customer>.greenhouse.io
Ubiquiti Networks $150 AirFibre products vulnerable to HTTP Header injection
shopify-scripts $800 forgot to add the patch
Nextcloud $183 Calendar and addressbook names disclosed (NC-SA-2017-012) CVE-2017-0895
WordPress $350 Wordpress 4.7.2 - Two XSS in Media Upload when file too large.
shopify-scripts $100 SIGSEGV - mrb_vm_exec - line:1312
Algolia $100 Reflected XSS
YouPorn $150 Find whether a video has been favourited or not, for any user [via YouPorn Mobile API]
Pornhub $1,500 Wordpress Content injection
Twitter $7,560 Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]
HackerOne $1,000 Subdomain takeover at info.hacker.one
VK.com $400 Missing Server Side Rate Limiting can Lead to VK Account Take over
Mapbox $750 Public access to objects in AWS S3 bucket
shopify-scripts $800 Denial of service (segfault) due to null pointer dereference in mrb_vm_exec
shopify-scripts $800 Denial of service (segfault) due to null pointer dereference in mrb_obj_instance_eval
Pornhub $250 XSS Vulnerability at https://www.pornhubpremium.com/premium_signup? URL endpoint
Pornhub $250 [xss] pornhubpremium.com, /redeem?code= URL endpoint
Phabricator $300 User with only Viewing Privilege can send message to Room
shopify-scripts $100 Null pointer dereference in mrb_random_initialize
Instacart $100 Login with Google Not Authenticated on iOS App
Ubiquiti Networks $600 Wordpress directories/files visible to internet
YouPorn $1,000 Account hijack via deleted PH account
shopify-scripts $800 SIGSEGV - vm.c - line:1214
shopify-scripts $100 Segmentfault at mrb_vm_exec
shopify-scripts $2,000 Recursion causing uninitialized memory reads leading to a segfault
Automattic $250 cloudup Subdomain Takeover That resolves to Desk.com ( CNAME cloudup.desk.com )
LocalTapiola $400 Single user DOS on selectedLanguage -cookie (yrityspalvelu.lahitapiola.fi)
Ubiquiti Networks $150 Can upload files without authentication on AirFibre 3.2
OpenSSL (IBB) $1,000 CVE-2017-3730: Bad (EC)DHE parameters cause a client crash
LocalTapiola $100 Enumeration in unsubscribe -function of /omatalousuk (viestinta.lahitapiola.fi)
Twitter $5,040 Attacker can get vine repost user all informations even Ip address and location .
LocalTapiola $150 Reflected XSS on iltakoulu_varkaus (viestinta.lahitapiola.fi)
PHP (IBB) $500 Out of bounds memory read in unserialize() CVE-2016-10161
Algolia $100 [github.algolia.com] DOM Based XSS github-btn.html
shopify-scripts $100 heap-use-after-free /home/operac/testafl/mruby/mrubylast/mruby/src/gc.c
LocalTapiola $1,350 SQL Injection /webApp/cancel_iltakoulu regId parameter (viestinta.lahitapiola.fi)
Ubiquiti Networks $100 [nutty.ubnt.com] DOM Based XSS nuttyapp github-btn.html
LocalTapiola $50 CSRF bypass + XSS on verkkopalvelu.tapiola.fi
Alvosec $3 Alvocrypt uses a cryptographically insecure PRNG.
Slack $1,000 Access of Android protected components via embedded intent
shopify-scripts $100 Incorrect code generation with redo inside NODE_RESCUE.
LocalTapiola $1,350 SQL Injection on /webApp/lapsuudenturva (viestinta.lahitapiola.fi)
LocalTapiola $350 Sql injection on /webApp/sijoituswebinaari (viestinta.lahitapiola.fi)
LocalTapiola $350 SQL Injection on /webApp/viivanalle (viestinta.lahitapiola.fi)
Harvest $250 Persistent XSS on ForecastApp
HackerOne $500 Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com
shopify-scripts $800 Aborted - proc.c - line:143
Twitter $560 Clickjacking Periscope.tv on Chrome
shopify-scripts $100 SIGABRT - mrb_realloc_simple - gc.c - line:201
QIWI $150 [XSS/pay.qiwi.com] Pay SubDomain Hard-Use XSS
QIWI $250 [XSS/3dsecure.qiwi.com] 3DSecure XSS
Ubiquiti Networks $2,000 [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 users
shopify-scripts $100 Crash in print_backtrace
Discourse $256 Stored XSS in posts because of absence of oembed variables values escaping
Discourse $256 Stored XSS in topics because of whitelisted_generic engine vulnerability
shopify-scripts $800 Null pointer dereference in mrb_str_modify
shopify-scripts $800 Still heap overflow in mrb_ary_splice
shopify-scripts $100 SIGSEGV - mrb_obj_extend - line:413
shopify-scripts $800 SIGSEGV - mrb_vm_exec - line:1681
Discourse $256 XSS in topics because of bandcamp preview engine vulnerability
VK.com $300 SSRF через Share-ботов
Rockstar Games $650 [IMP] - Blind XSS in the admin panel for reviewing comments
Rockstar Games $500 Ability to post comments to a crew even after getting kicked out
YouPorn $1,000 IDOR - Access to private video thumbnails even if video requires password authentication
VK.com $100 Возможность смотреть видео рекомендации любого пользователя вконтакте
Starbucks $375 Open redirect / Reflected XSS payload in root that affects all your sites (store.starbucks.* / shop.starbucks.* / teavana.com)
shopify-scripts $800 Heap Buffer overflow in mrb_funcall_with_block
HackerOne $2,000 Disclose any user's private email through API
Slack $200 dom xss in https://www.slackatwork.com
shopify-scripts $800 Segmentation fault on program counter
Shopify $500 apps.shopify.com - CSRF token leakage through Google Analytics
shopify-scripts $800 SIGSEGV - mrb_vm_exec - vm.c in line:1272
shopify-scripts $800 SIGSEGV in mrb_vm_exec
Snapchat $250 RTLO char allowed in chat
Instacart $100 XSS in instacart.com/store/partner_recipe
PHP (IBB) $500 Use of uninitialized memory in unserialize() CVE-2017-5340
shopify-scripts $100 Segmentation fault - mrb_gc_mark
Slack $100 Subdomain takeover on podcasts.slack-core.com
Starbucks $250 SAP Server - default credentials enabled
Shopify $1,000 CSRF in all API endpoints when authenticated using HTTP Authentication
Open-Xchange $250 Set Cookie Via SVG
shopify-scripts $800 Heap overflow due to off-by-one when expanding stack
shopify-scripts $200 Heap use-after-free during range creation
Shopify $500 Authentication Bypass on monitoring server
LocalTapiola $100 OpenSSL Padding Oracle Attack (CVE-2016-2107) on viestinta.lahitapiola.fi
Yelp $100 Able to download arbitrary PHP files at yelpblog.com
Skyport Systems $25 Nginx version disclosure via forbidden page
LocalTapiola $400 Reflected XSS and Open Redirect (verkkopalvelu.lahitapiola.fi)
shopify-scripts $800 SIGABRT - mrb_default_allocf
shopify-scripts $800 SIGSEGV - kh_resize_iv - Null Deref
shopify-scripts $200 Double free of filename after codegen error
shopify-scripts $800 attempting double-free using the mruby compiler `mrbc`
Zendesk $2,000 a stored xss in web widget chat
shopify-scripts $800 Use After Free in str_replace
shopify-scripts $800 Null pointer dereference in mrb_str_prepend
shopify-scripts $800 mrb_str_modify try to write to memory not marked for writing
shopify-scripts $800 SIGSEGV - mrb_check_intern_str() - NullPointer
WebSummit $20 Subdomain Takeover at http://gameday.websummit.net
shopify-scripts $1,000 Memory disclosure in timegm
Mapbox $1,000 Mapbox Android SDK uses Broadcast Receiver instead of Local Broadcast Manager
shopify-scripts $800 SIGSEGV Null Pointer mrb_str_concat()
shopify-scripts $100 heap-buffer-overflow on mruby
YouPorn $1,000 Account takeover via Pornhub Oauth
LocalTapiola $150 Creating arbitrary cookies values /cs/CookieServer (www.lahitapiola.fi)
Discourse $128 Users can bookmark other user's messages
shopify-scripts $800 kh_get_n2s() stack overrun
shopify-scripts $800 SIGABRT, SIGSEGV mspace_free() and mrb_default_allocf()
shopify-scripts $800 SIGSEGV on mrb_vm_exec() Null Deref
Harvest $300 Unauthorised read Access to Expense Receipt of any user in the company(Vertical Privilege escalation)
shopify-scripts $800 Heap Overflow in mrb_arb_splice
shopify-scripts $100 mrb_vformat() heap overflow could lead to code execution
shopify-scripts $100 Integer Overflow in mrb_ary_set
Discourse $256 XSS vulnerability on Audio and Video parsers
Shopify $1,000 Stored XSS in blog comments through Shopify API
Shopify $500 XSS on postal codes
Badoo $280 CSRF Attack on (m.badoo.com)deleting account and erasing imported contacts
Ruby $500 Buffer underflow in sprintf
shopify-scripts $800 SIGSEGV mrb_obj_freeze() Manipulating Register RAX and RSI
Nextcloud $300 Limitation of app specific password scope can be bypassed (NC-SA-2017-009) CVE-2017-0892
shopify-scripts $800 SIGSEGV on mruby mrb_get_args()
Discourse $256 XSS Vulnerability on Image link parser
Discourse $256 DOM Based XSS in Discourse Search
shopify-scripts $1,000 Incorrect code generation when result of NODE_NEGATE is not used
Pornhub $1,000 XSS vulnerability using GIF tags
Legal Robot $20 Password complexity requirements not enforced
LocalTapiola $1,350 SQL Injection on /webApp/sijoitustalousuk email-parameter + potential lack of CSRF Token (viestinta.lahitapiola.fi)
LocalTapiola $450 Reflected XSS and Open Redirect in several parameters (viestinta.lahitapiola.fi)
Twitter $1,680 CRLF and XSS stored on ton.twitter.com
shopify-scripts $100 Invalid memory access in `mrb_str_format`
Twitter $140 Sub Domain Takeover at mk.prd.vine.co
Uber $2,500 Authorization issue in Google G Suite allows DoS through HTTP redirect
LocalTapiola $1,350 SQL Injection in lapsuudenturva (viestinta.lahitapiola.fi)
LocalTapiola $50 Reflected XSS on sankarikoulutus (viestinta.lahitapiola.fi)
Shopify $500 XSS on manually entering Postal codes
PHP (IBB) $500 Invalid parameter in memcpy function trough openssl_pbkdf2
PHP (IBB) $500 imagefilltoborder stackoverflow on truecolor images
Starbucks $250 Reflected XSS on teavana.com (Locale-Change)
LocalTapiola $1,350 SQL Injection in sijoitustalous_peruutus (viestinta.lahitapiola.fi)
QIWI $100 [qiwi.com] .bash_history
LocalTapiola $400 Open Redirect bypass and cookie leakage on www.lahitapiola.com
shopify-scripts $1,000 Segfault when passing invalid values to `values_at`
Quora $150 [Android] XSS via start ContentActivity
Quora $300 [controlsyou.quora.com] 429 Too Many Requests Error-Page XSS
HackerOne $500 Websites opened from reports can change url of report page
shopify-scripts $10,000 Certain inputs cause tight C-level recursion leading to process stack overflow
Shopify $500 Unauthenticated Stored XSS on <any>.myshopify.com via checkout page
Pornhub $5,000 Unsecured DB instance
Starbucks $500 Persistent XSS in www.starbucks.com
HackerOne $10,000 Information Disclosure in /skills call
Pornhub $750 Unsecured Kibana/Elasticsearch instance
shopify-scripts $10,000 Buffer overflow in mrb_time_asctime
shopify-scripts $8,000 Segmentation fault due to bad memory access in kh_get_mt
Starbucks $150 Dom Based Xss DIV.innerHTML parameters store.starbucks*
Twitter $280 Vine - overwrite account associated with email via android application
shopify-scripts $10,000 Null pointer derefence due to bug in codegen with negation without using value
Slack $500 Store XSS
shopify-scripts $10,000 Invalid handling of zero-length heredoc identifiers leads to infinite loop in the sandbox
Starbucks $2,000 Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS record
shopify-scripts $10,000 Crash: Overwriting NoMethodError with a builtin class crashes/corrupts memory
Pornhub $150 Stored XSS on the http://ht.pornhub.com/widgets/
Starbucks $100 Stored XSS in Adress Book (starbucks.com/account/profile)
Shopify $500 Stored XSS at 'Buy Button' page
Phabricator $300 Fetching binaries (for software installation) over HTTP without verification (RCE as ROOT by MITM)
Pornhub $1,500 IDOR - disclosure of private videos - /api_android_v3/getUserVideos
HackerOne $12,500 Internal attachments can be exported via "Export as .zip" feature
shopify-scripts $1,000 Crash: A call to Symbol.new leads to a crash when inspecting the resulting object
Ian Dunn $25 constant cache_page_secret in regolith
Ian Dunn $50 unchecked unserialize usages in audit-trail-extension/audit-trail-extension.php
Ian Dunn $25 unchecked unserialize usage in WordPress-Functionality-Plugin-Skeleton/functionality-plugin-skeleton.php
shopify-scripts $1,000 Invalid memory write caused by incorrect upper bound in array_copy
Twitter $560 Twitter for android is exposing user's location to any installed android app
Gratipay $1 Incomplete or No Cache-control and Pragma HTTP Header Set
Shopify $500 XSS in my.shopify.com in widget
shopify-scripts $8,000 Crash: mrb_any_to_s can't handle NilClass, Symbol and Fixnum
shopify-scripts $10,000 Crash: Initialize Decimal with itself triggers an assertion
shopify-scripts $1,000 Null pointer dereference regression in parse.y
shopify-scripts $18,000 Type confusion in wrap_decimal leading to memory corruption
shopify-scripts $20,000 Type confusion in mrb_exc_set leading to memory corruption
shopify-scripts $8,000 Crash: calling Proc::initialize_copy with a Proc instance where initialize never ran leads to a crash
shopify-scripts $1,000 Read after free in mrb_vm_exec with OP_ARYCAT reading R(B)
shopify-scripts $8,000 Denial of service due to invalid memory access in mrb_ary_concat
Slack $1,000 Eavesdropping on private Slack calls
shopify-scripts $8,000 mruby-time: Crash host with uninitialized Time obj
LocalTapiola $50 Disclosure of IBM Websphere page
LocalTapiola $450 XSS and open redirect in verkkopalvelu.lahitapiola.fi
Pornhub $520 Race Condition Vulnerability On Pornhubpremium.com
WordPress $350 [Buddypress] Arbitrary File Deletion through bp_avatar_set
LocalTapiola $100 SMTP configuration vulnerability viestinta.lahitapiola.fi
shopify-scripts $8,000 Segmentation fault when a Ruby method is invoked by a C method via Object#send
shopify-scripts $8,000 Null target_class DoS
shopify-scripts $10,000 Segfault and/or potential unwanted (byte)code execution with "break" and "||=" inside a loop
VK.com $500 Возможность провести DoS атаку от имени vk.com сервера
shopify-scripts $8,000 SIGSEGV on mruby's mark_tbl() (Invalid memory access)
shopify-scripts $8,000 SIGSEGV on mruby mrb_str_modify() (Invalid memory access)
Boozt Fashion AB $200 Email link poisoning / Host header attack
shopify-scripts $10,000 Broken handling of maximum number of method call arguments leads to segfault
Badoo $140 Email Spoofing
HackerOne $10,000 Partial disclosure of report activity through new "Export as .zip" feature
shopify-scripts $10,000 Null pointer dereference due to TOCTTOU bug in mrb_time_initialize
LocalTapiola $60 Option method enabled (viestinta.lahitapiola.fi)
Python (IBB) $500 Type confusion in FutureIter_throw() which may potentially lead to an arbitrary code execution
PortSwigger Web Security $350 XSS in IE11 on portswigger.net via Flash
Pornhub $200 Reflected cross-site scripting (XSS) vulnerability in pornhub.com allows attackers to inject arbitrary web script or HTML.
Udemy $300 Completed Compromise & Source Code Disclosure via Exposed Jenkins Dashboard at https://jenkins101.udemy.com
shopify-scripts $8,000 SIGSEV on mrb_ary_splice
Imgur $250 Stored xss in ALBUM DESCRIPTION
shopify-scripts $10,000 Range constructor type confusion DoS
shopify-scripts $20,000 TOCTTOU bug in mrb_str_setbyte leading the memory corruption
shopify-scripts $18,000 Struct type confusion RCE
shopify-scripts $10,000 SIGSEGV when invalid argument on remove_method
shopify-scripts $20,000 DoS: type confusion in mrb_no_method_error
Udemy $200 Jenkins
LocalTapiola $150 Multiple Reflected XSS /webApp/lahti (viestinta.lahitapiola.fi)
shopify-scripts $10,000 Segfault in mruby, mruby_engine and the parent MRI Ruby due to null pointer dereference
LocalTapiola $350 SQL Injection /webApp/sijoitustalous_peruutus locId parameter (viestinta.lahitapiola.fi)
VK.com $1,500 Stored XSS в личных сообщениях
LocalTapiola $264 HTML Injection in email /webApp/lahti (viestinta.lahitapiola.fi)
LocalTapiola $350 SQL Injection /webApp/oma_conf ctx parameter (viestinta.lahitapiola.fi)
LocalTapiola $60 Poodle attack SSLv3 Support (viestinta.lahitapiola.fi)
Twitter $1,120 [IDOR][translate.twitter.com] Opportunity to change any comment at the forum
shopify-scripts $8,000 Undefined method_missing null pointer dereference
shopify-scripts $10,000 Range#initialize_copy null pointer dereference
shopify-scripts $10,000 NULL pointer dereference when parsing ternary operators
Ubiquiti Networks $500 Subdomain Takeover (moderator.ubnt.com)
LocalTapiola $100 Error Page Content Spoofing or Text Injection (viestinta.lahitapiola.fi)
shopify-scripts $20,000 Use after free vulnerability in mruby Array#to_h causing DOS possible RCE
shopify-scripts $2,000 Memory disclosure in mruby String#lines method
shopify-scripts $8,000 Denial of Service in mruby due to null pointer dereference
Coinbase $100 Window.opener bug at www.coinbase.com
shopify-scripts $10,000 Exception cause SIGABRT
Legal Robot $40 Password reset access control
shopify-scripts $8,000 ruby DoS https://www.mruby.science
Legal Robot $40 Missing restriction on string size in profile fields
Yelp $300 X.509 certificate validation fails on international vanity domains
VK.com $300 SSRF (open) - via GET request
Trello $2,048 Stealing power up private tokens (trello, twitter, github...)
Zopim $100 Android SDK - CREATE_REQUEST broascast is unprotected
Open-Xchange $500 Reflected Cross-Site Scripting due to vulnerable Flash component (Flashmediaelement.swf)
Open-Xchange $100 Selecting encryption for email with drive attachment overrides the drive email password
LocalTapiola $100 Suspicious browser fingerprinting(?) scripts on http://www.lahitapiola.fi/ redirector
LocalTapiola $1,560 SQL Injection on /webApp/omatalousuk (viestinta.lahitapiola.fi)
Blockchain $100 Information disclosure at https://blockchain.atlassian.net
Open-Xchange $666 Tab nabbing via window.opener
Open-Xchange $300 Stored XSS in Template Documents
Blockchain $400 Reflected XSS on blockchain.info
VK.com $1,000 Новый 2FA Bypass
LocalTapiola $400 Open Redirect (verkkopalvelu.lahitapiola.fi)
Blockchain $50 server version dislosure
Ubiquiti Networks $500 Stored XSS in community.ubnt.com
Imgur $5,000 Unauthenticated Docker registry
Nextcloud $50 Content Spoofing in "files" app CVE-2017-0888
Yelp $500 CSRF on signup endpoint (auto-api.yelp.com)
Badoo $280 Leave inaccessible messaging system with a message (https://us1.badoo.com)
Badoo $260 Arbitrary modification value "session" (Cookie) in badoo.com
Instacart $100 Access private list metadata
Uber $1,000 ability to retrieve a user's phone-number/email for a given inviteCode
InVision $300 CORS Man-in-the-Middle account compromise
Shopify $1,500 Misconfiguration in Two Factor Authorisation
Twitter $280 SSRF in https://cards-dev.twitter.com/validator
QIWI $300 Раскрытие баланса на //kopilka.qiwi.com
Harvest $250 Stored XSS in Restoring Archived Tasks
Starbucks $375 CSRF exploit | Adding/Editing comment of wishlist items (teavana.com - Wishlist-Comments)
Starbucks $150 CSRF vulnerability in saving payment card on store.starbucks.com (COBilling -AddCreditCard)
Badoo $140 Unvalidated redirect on team.badoo.com
LocalTapiola $588 Lahitapiola´s customer names send to 3rd party
Starbucks $375 Reflected XSS by exploiting CSRF vulnerability on teavana.com wishlist comment module. (wishlist-comments)
Starbucks $250 CSRF: add item to victim's cart automatically (starbucks.com - updatecart)
LocalTapiola $750 Email Server Compromised at secure.lahitapiola.fi
Mindoktor $2,000 XSS at endpoint clinic.mindoktor.se in flash cookie
Mindoktor $300 Storing sensitive information on cookie post-registration
Coinbase $200 Authentication Issue
Brave Software $50 [ios] Address bar spoofing in Brave for iOS
Harvest $100 Editing a project (LIMITED)
Twitter $2,520 Cross-site scripting (reflected)
itBit Exchange $1,000 Round error issue -> produce money for free
Brave Software $100 Denial of service attack(window object) on brave browser
Shopify $500 race condition in adding team members
Brave Software $50 Denial of service attack on Brave Browser.
Coinbase $100 Information disclosure of user by email using buy widget
Brave Software $100 Access to local file system using javascript
Brave Software $200 [iOS/Android] Address Bar Spoofing Vulnerability
Brave Software $100 Address Bar Spoofing - Already resolved - Retroactive report
Brave Software $150 URI Obfuscation
Shopify $2,000 Able to Login deactivated staff account in shopify app mobile
Twitter $140 Full Path Disclosure at 27.prd.vine.co
Trello $256 Can run arbitrary script on em.trello.com
Brave Software $50 [website] Script injection in newsletter signup https://brave.com/brave_youth_program_signup.html
Brave Software $50 2 Directory Listing on ledger.brave.com & vault-staging.brave.com
PHP (IBB) $500 memcpy negative parameter _bc_new_num_ex
PHP (IBB) $500 memcpy negative size parameter in php_resolve_path
PHP (IBB) $500 Write out-of-bounds at number_format
Brave Software $100 Homograph attack
Shopify $500 [ecommerce.shopify.com] Invalidated redirection
Python (IBB) $1,000 chain.__setstate__ Type Confusion
Uber $1,000 Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront
Slack $700 Information Disclosure on stun.screenhero.com
WePay $200 Enumeration of registered email addresses using bruteforce search on userIds
Sucuri $500 Administrator Access to grafana instance logstash2.sucuri.net with default credentials
Yelp $500 Requesting Show CheckIn Alert for Non Friend User
Harvest $150 Linking Invoice to uninvited project.
Trello $128 XSS on blog.trello.com
Twitter $1,260 View liked twits of private account via publish.twitter.com
Badoo $140 No rate-limit in SERVER_SECURITY_CHECK
BrickFTP $250 Existence of Folder path by guessing the path through response
Nextcloud $250 Filename enumeration && DoS
Twitter $560 Circumventing the Twitter account lockout process [ACCOUNT TAKEOVER]
Harvest $300 Cookie Injection at 'harvestapp.com'
Trello $128 Full Sub Domain Takeover at help.trello.com.
Zopim $150 Full Sub Domain Takeover at wx.zopim.net
Slack $500 CSRF in github integration
PHP (IBB) $1,000 Buffer overflow in HTTP parse_hostinfo(), parse_userinfo() and parse_scheme()
ok.ru $100 web.xml configuration file disclosure
Instacart $150 Full access to any list
Boozt Fashion AB $400 Git available containing passwords.
Romit $513 [CRITICAL]-Taking over entire subdomain of romit.io
Uber $10,000 password reset token leaking allowed for ATO of an Uber account
Legal Robot $40 Bypass 8 chars password complexity with 6 chars only due to insecure password reset functionaliy
Snapchat $250 Bypassing "You've requested your data the maximum number of times today." + "Please Verify an email address with snapchat to continue"
Rockstar Games $500 DOM based reflected XSS in rockstargames.com/newswire/tags through cross domain ajax request
Shopify $500 password less login token expiration issue
Starbucks $750 out of date disqus shortname usage in the web app source code
Shopify $500 Add signature to transactions without any permission
Udemy $50 Content Spoofing in udemy
WebSummit $40 Subdomain take over signup.websummit
LocalTapiola $50 Reflected XSS in LTContactFormReceiver (/cs/Satellite)
Automattic $100 Follow Button XSS
Python (IBB) $1,500 LZMADecompressor.decompress Use After Free
PHP (IBB) $500 Heap overflow caused by type confusion vulnerability in merge_param()
Legal Robot $20 Information Disclosure on rate limit defense mechanism
Ubiquiti Networks $500 Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com
InVision $150 CRITICAL Any █████ of any screen can be removed by anyone!
Legal Robot $20 Near-duplicate accounts allowed with ignored email mutations
Algolia $100 No rate limit for Referral Program
Maximum $75 Facebook and twitter page claimed of maximum.com [important]
LocalTapiola $18,000 Oracle Webcenter Sites administrative and hi-privilege access available directly from the internet (/cs/Satellite)
HackerOne $500 Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)
Trello $128 SSRF in account webhook (through API)
Mail.Ru $300 Time-based sql-injection на https://puzzle.mail.ru
Slack $400 Email information leakage for certain addresses
Shopify $500 Open redirect in bulk edit
Imgur $100 Stored XSS in albums on http://m.imgur.com/
Nextcloud $750 Bypass permissions
Twitter $2,100 Twitter iOS fails to validate server certificate and sends oauth token
Coinbase $100 Information leakage on https://docs.gdax.com
IRCCloud $50 Exposed, outdated nginx server (v1.4.6) potentially vulnerable to heap-based buffer overflow & RCE
Snapchat $250 Incoming email hijacking on sc-cdn.net
Uber $500 Users can falsely declare their own Uber account info on the monthly billing application
Shopify $500 Deleted Post and Administrative Function Access in eCommerce Forum
Boozt Fashion AB $80 Make victim buy in attacker's account without any idea - http://www.booztlet.com/
Python $1,000 msilib.OpenDatabase Type Confusion
Pornhub $750 Unsecured Grafana instance
Pornhub $750 Disclosure of private photos/albums - http://www.pornhub.com/album/show_image_box
Yelp $200 Bybass The Closing of the account and logged again to your account
Eobot $12 No password length restriction
Boozt Fashion AB $120 XSS
VK.com $1,050 Второй способ обхода 2FA
Shopify $500 XSS in SHOPIFY: Unsanitized Supplier Name can lead to XSS in Transfers Timeline
Twitter $560 leaking Digits OAuth authorization to third party websites
Shopify $500 Unsanitized Location Name in POS Channel can lead to XSS in Orders Timeline
Boozt Fashion AB $80 Instance of Apache Vulnerable to Several Issues
Boozt Fashion AB $120 Potential Subdomain Takeover Possible
Yelp $100 Self-XSS via location cookie city field when getting suggestions for a new location
Boozt Fashion AB $250 xss in Theme http://bztfashion.booztx.com
Keybase $100 Denial of Service through set_preference.json
Ruby $200 Arbitrary heap overread in strscan on 32 bit Ruby, patch included
OpenSSL $500 SSLv2 doesn't block disabled ciphers (CVE-2015-3197)
OpenSSL $2,500 Cross-protocol attack on TLS using SSLv2 (DROWN) (CVE-2016-0800)
Yelp $500 Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgot
Boozt Fashion AB $60 PHP info page disclosure on http://www.day.dk/
Harvest $500 Invoices can be added to any retainers - even closs-platform
Slack $500 Rate-limit bypass
Mindoktor $500 Vulnerable Mobile Phone configuration
Nextcloud $500 Reflected XSS in Gallery App CVE-2016-9466
Harvest $250 XSS on expenses attachments
Open-Xchange $300 OX (Guard): Stored Cross-Site Scripting via Email Attachment
Instacart $50 Seemingly sensitive information at /api/v2/zones
Python $1,000 urllib HTTP header injection CVE-2016-5699
Shopify $500 Access to Splunk via shard3-db2.ec2.shopify.com endpoint
Shopify $500 Open redirect allows changing iframe content in *.myshopify.com/admin/themes/<id>/editor
LocalTapiola $400 Open redirection protection bypass (/cs/Satellite)
Algolia $100 Hyperlink Injection in Friend Invitation Emails
LocalTapiola $400 SQL Injection on `/cs/Satellite` path
Legal Robot $60 Validation bypass on user profile
Ian Dunn $50 CSV Injection in Camptix
Twitter $5,040 [Studio.twitter.com] See someone else pics
LocalTapiola $100 Oracle WebCenter Sites Support Tools available and Information disclosure (/cs/Satellite)
LocalTapiola $50 Reflected XSS in www.lahitapiola.fi (/cs/Satellite) using Oracle WebCenter -page
Harvest $150 CSRF bypass on Submit Time sheet for Approval
Harvest $150 Project Manager can approve pending reports(Access control Issue)
Unikrn $400 Urgent: Server side template injection via Smarty template allows for RCE
QIWI $150 [qiwi.com] Information Disclosure
QIWI $150 [ibank.qiwi.ru] UI Redressing via Request-URI
Legal Robot $20 Possible content spoofing due to missing error page
Nextcloud $100 Reflected Self-XSS Vulnerability in the Comment section of Files Information
Slack $2,500 Snooping into messages via email service
Legal Robot $20 unsecured legalrobot.co.uk assets
VK.com $1,000 Обход 2ух-шаговой авторизации / 2FA Bypass
Legal Robot $20 Legal | Application is Missing CSP(Content Security Policy) Header
Legal Robot $20 CORS (Cross-Origin Resource Sharing)
Legal Robot $20 Information Disclosure in AWS S3 Bucket
Legal Robot $120 User Information leak allows user to bypass email verification.
Legal Robot $120 User Information sent to client through websockets
Instacart $100 WordPress Authentication Denial of Service
Dropbox $1,458 Subtile Code Injection Vulnerability in Dropbox for Windows
Uber $100 Stealing users password (Limited Scenario)
Slack $750 Code Injection in Slack's Windows Desktop Client leads to Privilege Escalation
Instacart $150 Fetch private list metadata and any user's personal name
Uber $5,000 Changing paymentProfileUuid when booking a trip allows free rides
Shopify $500 Open Redirect possible in https://www.shopify.com/admin/
Harvest $500 Possible to steal any protected files on Android
Bime $150 Subdomain takeover at ws.bimedb.com due to unclaimed Amazon S3 bucket
Instacart $50 READ .svg files by changing .svg into .png extension
Harvest $150 Extracting private info of estimates.
Ian Dunn $100 Bypass fix in https://hackerone.com/reports/151516 report.
Ian Dunn $50 Bypassing CSV injection using new line charcter
Coinbase $300 window.opener is leaking to external domains upon redirect on Safari
Instacart $150 Brute force login and bypass locked account restrictions via iOS app
Shopify $500 [apps.shopify.com] Open Redirect
Snapchat $400 [render.bitstrips.com] Stored XSS via an incorrect avatar property value
Instacart $150 Issues with uploading list images
Shopify $500 Open CouchDB on experiments.ec2.shopify.com:5984
HackerOne $500 Information leakage of private program
Shopify $500 Open redirect using checkout_url
HackerOne $500 Requesting Mediation possible on reports that are too old for mediation
QIWI $950 [qiwi.com] Oauth захват аккаунта
LocalTapiola $3,000 Blind Stored XSS Against Lahitapiola Employees - Session and Information leakage
Slack $1,000 Stored XSS(Cross Site Scripting) In Slack App Name
Harvest $150 Unauthorized read access to Invoices by PM (Access control Issues)
Harvest $150 Unauthorized access to all the actions of invoices by PM (Access control Issues)
Harvest $100 PM can delete payment of any invoice in company (Access control Issue)
Harvest $100 Record payment for any invoice by PM (Access control Issue)
Harvest $100 PM can delete the company logo image (Vertical Privilege Escalation )
Starbucks $150 Improper Validation on Cancel Link Redirect
HackerOne $1,000 Hacker.One Subdomain Takeover
Harvest $250 PM with can Set up email for invoices and estimates (Access control Issue)
Binary.com $75 Cross site scripting
Instacart $100 Hyperlink Injection in Friend Invitation Emails
Ubiquiti Networks $150 [scores.ubnt.com] DOM based XSS at form.html
Mapbox $750 Blind XSS in mapbox.com/contact
Shopify $1,000 (BYPASS) Open redirect and XSS in supporthiring.shopify.com
Trello $1,024 File access using image tragick
HackerOne $500 Non-secure requests are not automatically upgraded to HTTPS
Instacart $250 shopper login_code's can be brute forced
Twitter $560 reverb.twitter.com redirects to vulnerable reverb.guru
Shopify $500 Access to Splunk at https://apt.ec2.shopify.com:8089
Instacart $100 Image Upload Path Disclosure
Instacart $150 Host Header Injection/Redirection in: https://www.instacart.com/
Instacart $50 Server side request forgery on image upload for lists
Instacart $75 Missing rel=noreferrer tag allows link in list to change url of currently open tab
Instacart $200 Race Condition in Redeeming Coupons
Instacart $100 Cross-Site Request Forgery (CSRF)
Instacart $150 Stored XSS
Instacart $50 CSRF To change Email Notification Settings
Shopify $500 (FULL PATH DISCLOSURE) Unknown MySQL server host 'shardm-reader.chi2.shopify.io'
HackerOne $500 Disclosure of external users invited to a specific report
SecNews $300 Querying private posts and changing post meta
Gratipay $1 Avoid "resend verification email" confusion
Ubiquiti Networks $500 IDOR Causing Deletion of any account
Uber $10,000 Reading Emails in Uber Subdomains
Algolia $400 Unauthorized team members can leak information and see all API calls through /1/admin/* endpoints, even after they have been removed.
Algolia $100 Stored XSS from Display Settings triggered on Save and viewing realtime search demo
Algolia $100 Stored xss
Algolia $100 Stored XSS triggered by json key during UI generation
Open-Xchange $1,000 OX (Guard): Stored Cross-Site Scripting via Incoming Email
Slack $500 CSRF - Add optional two factor mobile number
Shopify $500 Staff member can delete Private Apps
ownCloud $100 Arbitrary Code Injection in ownCloud’s Windows Client
Shopify $500 (BYPASS) Open Redirect after login at http://ecommerce.shopify.com
Twitter $1,120 Stealing User emails by clickjacking cards.twitter.com/xxx/xxx
Gratipay $1 Content Spoofing/Text Injection
Nextcloud $50 More content spoofing through dir param in the files app
Uber $3,000 Missing authorization checks leading to the exposure of ubernihao.com administrator accounts
Snapchat $3,000 Subdomain takeover on http://fastly.sc-cdn.net/
Shopify $500 Delete/modify your own comment after limited access(IDOR)
Harvest $150 Opportunity to set arbitrary cookies
Moneybird $50 [Stored Cross-Site-Scripting] When search about Incoming ( Manual Jurnal )
Shopify $1,000 Unauthorized access to Zookeeper on http://locutus-zk3.ec2.shopify.com:2181
Uber $500 Blind OOB XXE At "http://ubermovement.com/"
Nextcloud $100 IDOR - Disable sharing CVE-2016-9464
Twitter $1,120 csp bypass + xss
Rockstar Games $500 Reflected XSS via #tags= while using a callback in newswire http://www.rockstargames.com/newswire
Ian Dunn $50 Multiple XSS in Camptix Event Ticketing Plugin
Harvest $500 Project Disclosure of all Harvest Instances
Harvest $1,000 Leak of all project names and all user names , even across applications
Harvest $350 Users enumeration is possible through cycling through recurring[client_id] argument value.
Harvest $350 Stored XSS on invoice, executing on any subdomain
Harvest $250 CSRF token fixation in Sign in with Google
Harvest $1,000 S3 bucket takeover due to proxy.harvestfiles.com
Harvest $100 Cross-Site Request Forgery (CSRF)
Dashlane $100 Missing Access Control(IDOR) To Know LinkedAccounts
PHP $500 NULL Pointer Dereference in exif_process_user_comment
PHP $1,000 Out of bound read in exif_process_IFD_in_MAKERNOTE
Uber $5,000 Stored XSS on developer.uber.com via admin account compromise
Rockstar Games $750 CSRF in 'set.php' via age causes stored XSS on 'get.php' - http://www.rockstargames.com/php/videoplayer_cache/get.php'
Algolia $100 No Rate Limit In Inviting Similar Contact Multiple Times
Ian Dunn $375 CSV Injection at Camptix Event Ticketing
ownCloud $50 ownCloud 2.2.2.6192 DLL Hijacking Vulnerability
Uber $2,000 [IODR] Get business trip via organization id
Uber $3,000 Get organization info base on uuid
Slack $500 Creating Post on a restricted channel
Automattic $300 [bbPress] Stored XSS in any forum post.
Dropbox $729 SSRF allows access to internal services like Ganglia
Shopify $1,500 Stealing livechat token and using it to chat as the user - user information disclosure
QIWI $200 Xss on billing
Uber $1,000 newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf
Shopify $500 https://windsor.shopify.com/ takeover
Twitter $420 Html Injection and Possible XSS in sms-be-vip.twitter.com
Uber $4,000 SQL Injection on sctrack.email.uber.com.cn
IRCCloud $500 Cross Site Scripting(XSS) on IRCCloud Badges Page (using Parameter Pollution)
Bime $1,000 Attacker can access graphic representation of every query
Bime $1,000 Urgent: attacker can access every data source on Bime
Nextcloud $50 Content (Text) Injection at NextCloud Server 9.0.52 - via http://custom_nextcloud_url/remote.php/dav/files/ CVE-2016-9468
Uber $2,250 Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com
WordPress $1,337 CSRF to add admin [wordpress]
Legal Robot $40 AWS S3 website can't serve security headers, may allow clickjacking
Whisper $100 Stored XSS in wis.pr
Ubiquiti Networks $185 Reflected Xss in AirMax [Nanostation Loco M2]
Algolia $100 Stored xss
Slack $500 a stored xss issue in https://files.slack.com
Maximum $20 Application error message
Phabricator $600 HTML in Diffusion not escaped in certain circumstances
Paragon Initiative Enterprises $50 Stored XSS using SVG
Slack $500 "a stored xss issue in share post menu"
Maximum $20 Microsoft IIS tilde directory enumeration
Legal Robot $100 Subdomain takeover at api.legalrobot.com due to non-used domain in Modulus.io.
Pornhub $1,500 [idor] Unauthorized Read access to all the private posts(Including Photos,Videos,Gifs)
Paragon Initiative Enterprises $25 Stored XSS in comments
Paragon Initiative Enterprises $50 Stored Cross-Site-Scripting in CMS Airship's authors profiles
Keybase $350 Register multiple users using one invitation (race condition)
VK.com $100 Паблики: Модератор паблика может удалять добавленные редакторами материалы с таймером на публикацию.
Uber $1,000 Wordpress Vulnerabilities in transparencyreport.uber.com and eng.uber.com domains
Slack $1,500 Source code leakage through GIT web access at host '52.91.137.42'
HackerOne $500 Know undisclosed Bounty Amount when Bounty Statistics are enabled.
Badoo $140 Change contents of the careers iframe in https://corp.badoo.com/jobs
Moneybird $25 Logging out any user
Coinbase $100 Application error message
Slack $100 Generate new Test token
Slack $100 User can start call in a channel of an unpaid account
The Internet $500 ntpd: read_mru_list() does inadequate incoming packet checks CVE-2016-7434
Maximum $20 The POODLE attack (SSLv3 supported)
Maximum $20 RC4 cipher suites detected
HackerOne $500 Race Conditions in Popular reports feature.
LocalTapiola $150 Mixed Active Scripting Issue on https://www.lahitapiola.fi
Pornhub $500 RCE Possible Via Video Manager Export using @ character in Video Title
PHP $1,000 ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
PHP $1,000 Use After Free Vulnerability in PHP's GC algorithm and unserialize
Nextcloud $100 Read-only share recipient can restore old versions of file
Nextcloud $250 Uploading files to a folder where invited user don't have any EDIT privilege
Algolia $100 2-factor authentication bypass
Vimeo $600 Downloading password protected / restricted videos
Nextcloud $50 Nextcloud server software: Content Spoofing
Nextcloud $350 Share owner has no possibility to list all existing derived shares
Nextcloud $750 Stored XSS on Share-popup of a directory's Gallery-view
Uber $7,000 xss in https://www.uber.com
Ubiquiti Networks $1,000 Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entry
Uber $1,500 Bulk UUID enumeration via invite codes
Ubiquiti Networks $150 [account-global.ubnt.com] CRLF Injection
Ian Dunn $50 Stored XSS from ticket messages in admin table in SupportFlow
Ian Dunn $50 Stored XSS in SupportFlow Ticket Subject
Python $1,000 CVE-2016-0772 - python: smtplib StartTLS stripping attack
Sucuri $250 [support.sucuri.net] CRLF Injection
Sucuri $250 SSRF in sitecheck.sucuri.net
Mail.Ru $150 [townwars.mail.ru] Time-Based SQL Injection
Uber $750 Brute-Forcing invite codes in partners.uber.com
bitaccess $200 EXTREMELY URGENT: Missing control of bitcoin amount when selling bitcoin allows a user to withdraw any amount of money, unrestricted.
Ruby $500 StringIO strio_getline() can divulge arbitrary memory
HackerOne $500 All information is not removed from published reports
Instacart $100 Authorization Bypass in Delivery Chat Logs
The Internet $7,500 Insufficient shell characters filtering leads to (potentially remote) code execution (CVE-2016-3714)
Slack $500 File upload over private IM channel
Uber $10,000 Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)
Badoo $280 Получение оригинала скрытого изображения
Shopify $3,000 Authentication Bypass on Icinga monitoring server
Shopify $1,500 Potentially Sensitive Information on GitHub
Mail.Ru $250 Mail.ru for Android Content Provider Vulnerability
Mapbox $500 XSS on www.mapbox.com/authorize/ because of open redirect at /core/oauth/auth
Mapbox $500 XSS on www.mapbox.com/authorize
Gratipay $40 upgrade Aspen on inside.gratipay.com to pick up CR injection fix
drchrono $50 Information Disclosure
Python $500 Heap corruption via Python 2.7.11 IOBase readline()
Uber $750 xss vulnerability in http://ubermovement.com/community/daniel
drchrono $50 Bug Report
Moneybird $50 [STORED XSS] in debtor reports of ,,invoices''
WePay $250 Invited users can modify and/or remove account owner
Shopify $500 Fetching external resources through svg images
LocalTapiola $100 DOM XSS bypassing in Regional Office -selector
Pornhub $10,000 [RCE] Unserialize to XXE - file disclosure on ams.upload.pornhub.com
Twitter $560 Information Disclosure through .DS_Store in ██████████
Mail.Ru $150 [tidaltrek.mail.ru] SQL Injection
OpenSSL $500 CVE-2016-2177 Undefined pointer arithmetic in SSL code
Pornhub $1,500 (Pornhub & Youporn & Brazzers ANDROID APP) : Upload Malicious APK / Overrite Existing APK / Android BackOffice Access
VK.com $1,500 XSS в upload.php
drchrono $50 User with no permissions can create, edit, delete favorite prescriptions /erx/
Slack $200 [Screenhero] Subdomain takeover
Ubiquiti Networks $125 Stored XSS in unifi.ubnt.com
Pornhub $20,000 [phpobject in cookie] Remote shell/command execution
Pornhub $1,000 Private Photo Disclosure - /user/stream_photo_attach?load=album&id= endpoint
drchrono $50 Bypassing Password Reset
GlassWire $25 Bypass GlassWire's monitoring of Hosts file
HackerOne $500 Able to remove the admin access of my program
drchrono $50 User with no permissions can access full wdcalendar feed
drchrono $50 Stored XSS via AngularJS Injection
Ubiquiti Networks $260 Open Redirect in unifi.ubnt.com [Controller Finder]
drchrono $50 [CRITICAL] CSRF leading to account take over
Mail.Ru $150 Code source discloure & ability to get database information "SQL injection" in [townwars.mail.ru]
Zendesk $100 XSS in zendesk.com/product/
drchrono $100 Angular injection in the profile name of onpatient
drchrono $50 Template stored XSS
drchrono $50 node.drchrono.com - Information Disclosure and Windows Host Exposed
drchrono $50 Ngnix Server version disclosure
Starbucks $4,000 Parameter Manipulation allowed for editing the shipping address for other user’s teavana.com subscriptions.
Starbucks $6,000 Parameter Manipulation allowed for viewing of other user’s teavana.com orders
drchrono $50 Bypass password complexity requirements on passsword reset page
drchrono $100 Security Issue : CSRF Token Design Flaw
Mail.Ru $150 [tidaltrek.mail.ru] SQL Injection
Mail.Ru $100 [my.mail.ru] HTML injection в письмах от [email protected]
Starbucks $375 www.starbucks.co.uk Reflected XSS via utm_source parameter
Mail.Ru $160 [upload-X.my.mail.ru] /uploadphoto Insecure Direct Object References
Slack $500 Open Redirect on slack.com
Gratipay $10 configure a redirect URI for Facebook OAuth
Binary.com $50 CJ vulnerability in subdomain
Trello $128 XSS in Jetpack Plugin
LocalTapiola $100 Exploiting Secure Shell (SSH) on mobilelt.lahitapiola.fi
Phabricator $300 Passphrase credential lock bypass
Ubiquiti Networks $2,750 Read-Only user can execute arbitraty shell commands on AirOS
Automattic $500 WordPress core stored XSS via attachment file name
Badoo $280 Ability to collect users' ids that have visited a specific web page with malicious code
LocalTapiola $300 Persistent XSS at verkkopalvelu.tapiola.fi using spoofed React element and React v.0.13.3
Uber $7,000 OneLogin authentication bypass on WordPress sites via XMLRPC
Pornhub $750 [idor] Profile Admin can pin any other user's post on his stream wall
LocalTapiola $100 Remote Code Execution in NovaStor NovaBACKUP DataCenter backup software (Hiback)
Pornhub $1,000 SSRF & XSS (W3 Total Cache)
LocalTapiola $300 Abusing and Hacking the SMTP Server secure.lahitapiola.fi
WP API $100 Missing access control exposing detailed information on all users
Pornhub $1,000 [IDOR] Deleting other users comment
Pornhub $150 Same-Origin Method Execution bug in plupload.flash.swf on /insights
OpenSSL $1,000 Bleichenbacher oracle in SSLv2 (CVE-2016-0704)
OpenSSL $2,500 Divide-and-conquer session key recovery in SSLv2 (CVE-2016-0703)
Pornhub $5,000 Weak user aunthentication on mobile application - I just broken userKey secret password
Pornhub $1,500 [stored xss, pornhub.com] stream post function
Pornhub $250 XSS Reflected incategories*p
Pornhub $250 XSS ReflectedGET /*embed_player*?
Mail.Ru $150 SQL Injection
Pornhub $1,500 [IDOR] post to anyone even if their stream is restricted to friends only
Pornhub $100 CSV Macro injection in Video Manager (CEMI)
Vimeo $600 All Vimeo Private videos disclosure via Authorization Bypass
LocalTapiola $100 Amazon Bucket Accessible (http://inpref.s3.amazonaws.com/)
Sucuri $500 CRLF/HTTP header injection www.sucuri.net
ok.ru $500 Xss in m.ok.ru
OpenSSL $2,500 Padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
Ubiquiti Networks $1,000 Source code disclosure on https://107.23.69.180
Uber $8,000 [CRITICAL] -- Complete Account Takeover
Gratipay $1 don't leak server version of grtp.co in error pages
Moneybird $50 Reflected XSS in Backend search
Vimeo $750 CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go public
Mapbox $400 Denial of service in account statistics endpoint
Uber $10,000 OneLogin authentication bypass on WordPress sites
Moneybird $100 Employees with Any Permissions Can Create App with Full Permissions and Perform any API Action
OpenSSL $500 EBCDIC overread (CVE-2016-2176)
OpenSSL $500 EVP_EncryptUpdate overflow (CVE-2016-2106)
OpenSSL $500 EVP_EncodeUpdate overflow (CVE-2016-2105)
Romit $50 Session Fixation
Moneybird $25 information disclose
Shopify $500 View all deleted comments and rating of any app .
Uber $5,000 Multiple vulnerabilities in a WordPress plugin at drive.uber.com
LocalTapiola $400 Possibly big authorization problem in Lähitapiola´s varainhoito
Mapbox $1,000 Reflected cross-site scripting (XSS) on api.tiles.mapbox.com
LocalTapiola $100 HTTP status code manipluation & java stack trace
LocalTapiola $5,000 Blind Stored XSS Against Lahitapiola Employees - Session and Information leakage
PHP $1,500 Integer overflow in ZipArchive::getFrom*
HackerOne $2,500 RCE in profile picture upload
OpenSSL $500 ASN.1 BIO excessive memory allocation (CVE-2016-2109)
Mail.Ru $250 XSS с помощью специально сформированного файла.
Shopify $500 staff memeber can install apps even if have limitied access
Automattic $1,337 WordPress SOME bug in plupload.flash.swf leading to RCE
Automattic $1,337 WordPress Flash XSS in *flashmediaelement.swf*
Zendesk $250 XSS In /zuora/ functionality
LocalTapiola $100 Content Spoofing or Text Injection (404 error page injection)
Algolia $500 RCE on facebooksearch.algolia.com
Uber $2,000 Reflected XSS via Livefyre Media Wall in newsroom.uber.com
Automattic $75 XSS on www.wordpress.com
Moneybird $25 Content Spoofing In Moneybird
Udemy $50 Stored XSS at Udemy
Slack $1,000 Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIs
Zendesk $500 [HIGH RISK] CSRF could potentially delete a zendesk subdomain.
Moneybird $50 Open Redirect vulnerability in moneybird.com
Zendesk $100 AWS S3 bucket writable for authenticated aws user
Uber $7,500 Stored XSS in developer.uber.com
Twitter $840 [Critical] - Steal OAuth Tokens
Coinbase $100 User's legal name could be changed despite front end controls being disabled
Automattic $75 Akismet Several CSRF vulnerabilities
ownCloud $150 Open Redirector via (apps/files_pdfviewer) for un-authenticated users.
Gratipay $1 bring grtp.co up to A grade on SSLLabs
Moneybird $50 Stored XSS in Financial Account executing in Bank tab
Moneybird $100 Malicious File Upload
Ubiquiti Networks $275 Reflected XSS in scores.ubnt.com
Moneybird $150 XXE issue
Moneybird $25 Stored XSS thru SVG upload
bitaccess $50 BYASSING OTP Verification
Moneybird $50 CSV Injection with the CSV export feature
Trello $128 Cross site scripting in blog.trello.com
Slack $2,000 Authentication bypass leads to sensitive data exposure (token+secret)
Zendesk $50 Stored XSS on [your_zendesk].zendesk.com in Facebook Channel
Python $500 Python 2.7 strop.replace Integer Overflow
Twitter $700 xss in DM group name in twitter
Twitter $700 niche s3 buckets are readable/writeable/deleteable by authorized AWS users
Automattic $75 CPU utilization 99% on visiting wordpress site url & open redirect found
LocalTapiola $300 The PdfServlet-functionality used by the "Tee vakuutustodistus" allows injection of custom PDF-content via CSRF-attack
LocalTapiola $400 Cookie-based client-side denial-of-service to all of the Lähitapiola domains
Gratipay $10 Send email asynchronously
Algolia $100 No rate-limit in Two factor Authentication leads to bypass using bruteforce attack
Ubiquiti Networks $1,500 Read-Only user can execute arbitraty shell commands on AirOS
Trello $1,536 Payments informations are sent to the webhook when a team changes its visibility
OpenSSL $1,000 BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)
Gratipay $10 fix bug in username restriction
Snapchat $1,000 Administrator access to a Django Administration Panel on *.sc-corp.net via bruteforced credentials
InVision $400 CRITICAL : Delete Boards Admin's ( or any other user ) comment. ( IDOR )
HackerOne $2,500 AWS S3 bucket writeable for authenticated aws users
Gratipay $1 Limit email address length
Uber $5,000 Stored XSS on newsroom.uber.com admin panel / Stream WordPress plugin
Uber $250 Easy spam with USE My PHONE Feature
HackerOne $1,500 Web Authentication Endpoint Credentials Brute-Force Vulnerability
Badoo $852 [CRITICAL] Full account takeover using CSRF
HackerOne $500 New hacktivity view discloses report IDs of non-public reports
HackerOne $500 New hacktivity view discloses report IDs of non-public reports
PHP $1,000 php_snmp_error() Format String Vulnerability
Uber $5,000 Information regarding trips from other users
Uber $5,000 Possibility to get private email using UUID
Twitter $280 XSS using javascript:alert(8007)
Uber $3,000 Possible to View Driver Waybill via Driver UUID
LocalTapiola $100 www.lahitapiola.fi DOM XSS by choosing regional company
Uber $3,000 Stored XSS in archive.uber.com Due to Injection of Javascript:alert(0)
Coinbase $1,000 Sending payments via QR code does not require confirmation
Shopify $500 XSS on https://app.shopify.com/
Coinbase $500 Email leak in transcations in Android app
Trello $1,024 If a team is public, the web socket receives data about the Team visible boards
LocalTapiola $1,000 Posting modified information in 'Investment section' will cause unintended information change in verkkopalvelu.tapiola.fi
Uber $500 CBC "cut and paste" attack may cause Open Redirect(even XSS)
Uber $750 XSS In archive.uber.com Due to Mime Sniffing in IE
Uber $1,000 CSV Injection in business.uber.com
Uber $2,000 Stored XSS in drive.uber.com WordPress admin panel
Gratipay $10 prevent content spoofing on /~username/emails/verify.html
Uber $10,000 uber.com may RCE by Flask Jinja2 Template Injection
Uber $3,000 SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/
Uber $3,000 Reflected XSS via Unvalidated / Open Redirect in uber.com
Uber $5,000 Possibility to brute force invite codes in riders.uber.com
Uber $3,000 Dom Based Xss
Uber $500 Estimation of a Lower Bound on Number of Uber Drivers via Enumeration
Mapbox $1,000 XSS (cross-site scripting) on www.mapbox.com/maki
Uber $3,000 Avoiding Surge Pricing
Uber $2,000 Bypassing Uber Partner's 3 Cancel Limit
Uber $3,000 Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers
Uber $3,000 SQLi in love.uber.com
Uber $1,500 Lack of CNAME/A Record Trimming Pointing Uber Domains to Insecure Non-Uber AWS Instances/Sites
Uber $3,000 XSS in getrush.uber.com
Uber $3,000 Reflected XSS on developer.uber.com via Angular template injection
Uber $500 Open Redirect in m.uber.com
Gratipay $1 Hijacking user session by forcing the use of invalid HTTPs Certificate on images.gratipay.com
HackerOne $1,500 External programs revealing info
HackerOne $500 Websites opened from reports can change url of report page
Shopify $500 Bypassed password authentication before enabling OTP verification
HackerOne $500 Disclosure of private programs that have an "external" page on HackerOne
Shopify $500 Stored XSS via "Free Shipping" option (Discounts)
Imgur $100 XSS via React element spoofing
HackerOne $500 CSV Injection via the CSV export feature
Shopify $1,500 Shopify GitHub Login and Password exposed all private source code might be available.
Trello $768 Using WebSocket I can always access organization data even if I am removed
Gratipay $1 auto-logout after 20 minutes
Gratipay $1 Cookie Does Not Contain The "secure" Attribute
Gratipay $1 suppress version in Server header on gratipay.com or grtp.co
HackerOne $500 SECURITY: Referencing previous Reports attachment_IDs on new Reports via Draft_Sync DELETES Attachments
HackerOne $500 Mediation link can be accepted by other users
LocalTapiola $500 CSRF allows attacker to delete item from customer's "Postilaatikko"
Shopify $500 XSS on hardware.shopify.com
HackerOne $1,000 Edit Auto Response Messages
Mail.Ru $200 bgplay.mail.ru
Shopify $500 Stored XSS in https://checkout.shopify.com/
Imgur $5,000 Local file read in image editor
Mapbox $200 Mapbox API Access Token with No Scope Can Read Styles
Ubiquiti Networks $1,300 Shell Injection via Web Management Console (dl-fw.cgi)
Vimeo $100 Private, embeddable videos leaks data through Facebook & Open Graph
PHP $1,000 Buffer overflow in HTTP url parsing functions
Badoo $850 Account Takeover
LocalTapiola $400 CRLF injection in https://verkkopalvelu.lahitapiola.fi/
Badoo $427 Broken Authentication on Badoo
Bime $150 Subdomain takeover due to unclaimed Amazon S3 bucket on a2.bime.io
Bime $250 SSRF issue
Gratipay $1 don't serve hidden files from Nginx
Pornhub $250 Public Facing Barracuda Login
OpenSSL $500 BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption (CVE-2016-0797)
Pornhub $2,500 Unprotected Memcache Installation running
Pornhub $50 HTTP Track/Trace Method Enabled
Twitter $1,120 DOMXSS in Tweetdeck
Mail.Ru $150 By pass admin panel [conference.mail.ru]
Mail.Ru $150 By pass admin panel [seminars.mail.ru]
Ubiquiti Networks $1,500 Read-Only user can execute arbitraty shell commands on AirOS
Udemy $150 Session Takeover vulnerability
Shopify $500 xss in the all widgets of shopifyapps.com
Uber $500 Open Redirection on Uber.com
HackerOne $500 User with Read-Only permissions can edit the Internal comment Activities on Bug Reports After Revoke the team access permissions
Twitter $280 Sub-Domain Takeover
InVision $500 CRITICAL Stored XSS in https://projects.invisionapp.com
Udemy $150 Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulate
Coinbase $500 Misconfiguration in 2 factor allows sensitive data expose
Twitter $2,520 Tweet Deck XSS- Persistent- Group DM name
HackerOne $500 Distinguish EP+Private vs Private programs in HackerOne
Algolia $1,000 API Key added for one Indices works for all other indices too.
OpenSSL $500 CVE-2016-0799 memory issues in BIO_*printf functions
HackerOne $500 User with Read-Only permissions can manually public disclosure the report
Shopify $500 File name and folder enumeration.
Coinbase $200 XSSI (Cross Site Script Inclusion)
HackerOne $500 CSV Injection at the CSV export feature
QIWI $150 Content Spoofing in mango.qiwi.com
VK.com $100 Дорк
Mail.Ru $500 Admin panel access restrictions bypass [poll.mail.ru/admin/]
Gratipay $1 limit number of images in statement
Zendesk $50 Stored XSS via Angular Expression injection on developer.zendesk.com
Gratipay $1 strengthen Diffie-Hellman (DH) key exchange parameters in grtp.co
Shopify $500 XSS in Draft Orders in Timeline i SHOPIFY Admin Site!
Gratipay $1 stop serving grtp.co over HTTP
Gratipay $10 DMARC is misconfigured for grtp.co
Uber $3,000 Reflected XSS on Uber.com careers
Gratipay $10 Prevent content spoofing on /~username/emails/verify.html
Gratipay $2 SPF/DKIM/DMARC for aspen.io
Mail.Ru $250 SSRF на element.mail.ru
Gratipay $2 SPF/DKIM/DMARC for grtp.co
Gratipay $1 limit HTTP methods on other domains
Gratipay $10 Email Forgery through Mandrillapp SPF
Uber $250 Multiple Vulnerabilities (Including SQLi) in love.uber.com
Uber $3,000 XSS @ love.uber.com
Gratipay $10 No Valid SPF Records.
HackerOne $500 Increase number of bugs by sending duplicate of your own valid report
Zopim $100 Chat History CSV Export Excel Injection Vulnerability
Legal Robot $20 SSL Issue on legalrobot.com
HackerOne $500 Private Program Disclosure in /:handle/settings/allow_report_submission.json endpoint
VK.com $200 vk.com/login.php
Legal Robot $20 SPF Issue
Legal Robot $120 Remote Code Execution (upload)
Mail.Ru $600 VERY DANGEROUS XSS STORED inside emails
Mail.Ru $150 [3k.mail.ru] SQL Injection
Ubiquiti Networks $1,000 Auth bypass on directory.corp.ubnt.com
Slack $100 an xss issue in https://hunter22.slack.com/help/requests/793043
Gratipay $1 The POODLE attack (SSLv3 supported) for https://grtp.co/
WePay $150 2-step Verification bypass
Python $1,000 Type confusion in partial.setstate, partial_repr, partial_call leads to memory corruption, reliable control flow hijack
Sucuri $500 Manipulating of Sucuri.net (List Subscription) Emails (HTML/Script Injection)
HackerOne $500 Private Program Disclosure in /:handle/reports/draft.json endpoint
HackerOne $5,000 Private program activity timeline information disclosure
Shopify $500 XSS on hardware.shopify.com
Imgur $1,000 SSRF / Local file enumeration / DoS due to improper handling of certain file formats by ffmpeg
Imgur $800 SSRF and local file read in video to gif converter
Legal Robot $20 Rate limiting on Email confirmation link
Imgur $2,000 SSRF in https://imgur.com/vidgif/url
Paragon Initiative Enterprises $50 Full Path Disclosure
Mail.Ru $300 [orsotenslimselfie.lady.mail.ru] SQL Injection
Gratipay $10 prevent content spoofing on /search
Gratipay $5 SPF DNS Record
Keybase $50 Content spoofing due to the improper behavior of the not-found meesage
HackerOne $500 Putting link inside link in markdown
Keybase $350 Race conditions can be used to bypass invitation limit
Keybase $250 Remote Server Restart Lead to Denial of Service by only one Request.
Mapbox $200 Content Spoofing and Local Redirect in Mapbox Studio
VK.com $2,500 Внедрение внешних сущностей в функционале импорта пользователей YouTrack
Shopify $500 CSRF on https://shopify.com/plus
Twitter $2,520 Bypassing Digits web authentication's host validation with HPP
Snapchat $1,000 Subdomain takeover in http://support.scan.me pointing to Zendesk (a Snapchat acquisition)
Keybase $250 Remote Server Restart Lead to Denial of Server by only one Request.
OpenSSL $2,500 OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
Paragon Initiative Enterprises $50 Open-redirect on paragonie.com
HackerOne $500 Multiple issues with Markdown and URL parsing
withinsecurity $250 WordPress Failure Notice page will generate arbitrary hyperlinks
HackerOne $500 Unintended HTML inclusion as a result of https://hackerone.com/reports/110578
Mail.Ru $300 [afisha.mail.ru] SQL Injection
Coinbase $1,000 Session Issue Maybe Can lead to huge loss [CRITICAL]
Binary.com $250 Full takeover of some binary.com sub domains
Bime $100 The JDBC driver used by the Vertica connector allows to create files on the backends
Bime $1,000 SSRF in the Connector Designer (REST and Elastic Search)
Bime $750 XXE in the Connector Designer
HackerOne $500 Interstitial redirect bypass / open redirect in https://hackerone.com/zendesk_session
Mail.Ru $150 [allods.my.com] SSRF / XSPA
Zendesk $100 [CRITICAL] HTML injection issue leading to account take over
withinsecurity $250 Error Page Text Injection #106350
Imgur $50 Big Bug in SSL : breach compression attack (CVE-2013-3587) affect imgur.com
Shopify $500 Full access to Amazon S3 bucket containing AWS CloudTrail logs
Automattic $75 XSS at wordpress.com
Shopify $500 www.shopify.com XSS via third-party script
Trello $1,152 DOM based XSS via Wistia embedding
VK.com $100 Checking whether user liked the media or not even when you are blocked
Vimeo $100 Legacy API exposes private video titles
Automattic $75 XSS at www.woothemes.com
Pornhub $1,500 [ssrf] libav vulnerable during conversion of uploaded videos
Shopify $500 Attach Pinterest account - no State/CSRF parameter in Oauth Call back
Shopify $500 Twitter Disconnect CSRF
HackerOne $500 CSV Injection via the CSV export feature
withinsecurity $250 Content Spoofing OR Text Injection in https://withinsecurity.com
Gratipay $15 Sub Domian Take over
Automattic $250 Internal GET SSRF via CSRF with Press This scan feature
ownCloud $250 Information Exposure Through Directory Listing CVE-2016-1499
HackerOne $500 HTML injection can lead to data theft
Twitter $5,040 Bypassing Digits bridge origin validation
Perl $1,000 Perl 5.22 VDir::MapPathA/W Out-of-bounds Reads and Buffer Over-reads
Phabricator $300 Extended policy checks are buggy
Udemy $25 CSRF in Udemy.com
Coinbase $200 Direct URL access to completed reports
Ubiquiti Networks $500 Subdomain Takeover in http://assets.goubiquiti.com/
HackerOne $500 User with Read-Only permissions can request/approve public disclosure
Mail.Ru $150 [parapa.mail.ru] SQL Injection
PHP $1,000 Use After Free in sortWithSortKeys()
Gratipay $5 HTTP trace method is enabled
Twitter $2,520 Bypassing callback_url validation on Digits
ownCloud $350 Exploiting unauthenticated encryption mode
Ubiquiti Networks $150 Reflected File Download in community.ubnt.com/restapi/
VK.com $500 API: Bug in method auth.signup , дающий возможность бесконечно звонить
Mail.Ru $150 [cfire.mail.ru] Time Based SQL Injection
Mail.Ru $500 reflected in xss
HackerOne $500 Team Member(s) associated with a Group have Read-only permission (Post internal comments) can post comment to all the participants
WePay $100 Unauthenticated Stored XSS in API Panel
Automattic $50 Possible Timing Side-Channel in XMLRPC Verification
GlassWire $100 GlassWireSetup.exe subject to EXE planting attack
Imgur $150 XSS in imgur mobile 3
Imgur $150 XSS in imgur mobile
Shopify $500 Stored XSS in /admin/orders
VK.com $100 Добавление в меню сообщества без ведома пользователя (нажатия пользователем)
Zendesk $500 Stored XSS in comments
Shopify $500 Strored Cross Site Scripting
PHP $1,000 Format string vulnerability in zend_throw_or_error()
Shopify $500 HTTP-Response-Splitting on v.shopify.com
Maximum $20 Application error message
Coinbase $100 Race condition allowing user to review app multiple times
withinsecurity $250 text injection can be used in phishing 404 page should not include attacker text
Algolia $100 text injection can be used in phishing 404 page should not include attacker text
HackerOne $500 Improve signals in reputation
Shopify $500 Reflective XSS on wholesale.shopify.com
HackerOne $500 Team Member(s) associated with a Custom Group Created with 'Program Managment' only permissions can Comments on Bug Reports
Shopify $500 "Remember me" token generated when "Remember me" box unchecked
GlassWire $100 DLL Hijacking Vulnerability in GlassWireSetup.exe
HackerOne $500 Parameter pollution in social sharing buttons
HackerOne $500 Know whether private program for company exist or not
LeaseWeb $100 DOM Based XSS in Checkout
Shopify $500 many xss in widgets.shopifyapps.com
Pornhub $50 [crossdomain.xml] Dangerous Flash Cross-Domain Policy
Pornhub $250 PornIQ Reflected Cross-Site Scripting
Imgur $150 risk of having secure=false in a crossdomain.xml
Instacart $100 Cookie-Based Injection
Square Open Source $2,000 Unsafe usage of Ruby string interpolation enabling command injection in git-fastclone
Shopify $500 CSRF in Connecting Pinterest Account
Instacart $100 Cross-Site Scripting Reflected On Main Domain
Zopim $100 [status.zopim.com] Open Redirect
Automattic $75 XSS on codex.wordpress.org
Coinbase $200 HTML injection in apps user review
QIWI $200 [rubm.qiwi.com] Yui charts.swf XSS
Square Open Source $2,000 git-fastclone allows arbitrary command execution through usage of ext remote URLs in submodules
Shopify $1,000 shopifyapps.com XSS on sales channels via currency formatting
Slack $1,000 Trick make all fixed open redirect links vulnerable again
Python $500 tokenizer crash when processing undecodable source code
Python $1,000 PyFloat_FromString & PyNumber_Long Buffer Over-reads
PHP $500 Memory Corruption in phar_parse_tarfile when entry filename starts with null CVE-2015-4021
PHP $500 invalid pointer free() in phar_tar_process_metadata() CVE-2015-3307
Python $500 use after free in load_newobj_ex
Python $500 array.fromstring Use After Free
Python $1,000 bytearray.find Buffer Over-read
Python $500 hotshot pack_string Heap Buffer Overflow
Python $500 audioop.adpcm2lin Buffer Over-read
Python $500 audioop.lin2adpcm Buffer Over-read
PHP $500 Files extracted from archive may be placed outside of destination directory CVE-2015-6833
PHP $1,500 Multiple Use After Free Vulnerabilites in unserialize() CVE-2015-6831
PHP $1,000 Arbitrary code execution in str_ireplace function CVE-2015-6527
PHP $1,000 Dangling pointer in the unserialization of ArrayObject items CVE-2015-6832
PHP $500 curl_setopt_array() type confusion
The Internet $1,000 libcurl duphandle read out of bounds CVE-2014-3707
PHP $500 heap buffer overflow in enchant_broker_request_dict() CVE-2014-9705
PHP $500 Integer overflow in unserialize() (32-bits only) CVE-2014-3669
PHP $500 AddressSanitizer reports a global buffer overflow in mkgmtime() function CVE-2014-3668
PHP $1,500 SOAP serialize_function_call() type confusion / RCE CVE-2015-6836
PHP $500 zend_throw_or_error() format string vulnerability
PHP $1,000 Uninitialized pointer in phar_make_dirstream CVE-2015-7804
PHP $1,000 Buffer over-read in exif_read_data with TIFF IFD tag
PHP $500 Null pointer deref (segfault) in spl_autoload via ob_start
PHP $500 null pointer deref (segfault) in zend_eval_const_expr
PHP $500 Mem out-of-bounds write (segfault) in ZEND_ASSIGN_DIV_SPEC_CV_UNUSED_HANDLER
Python $1,000 Python deque.index() uninitialized memory
Python $500 Python scan_eol() Buffer Over-read
Python $500 time_strftime() Buffer Over-read
Python $500 Python xmlparse_setattro() Type Confusion
PHP $500 Use after free vulnerability in unserialize() with GMP
PHP $500 Use After Free Vulnerability in session deserializer CVE-2015-6835
PHP $1,000 Use After Free Vulnerability in unserialize() CVE-2015-6834
PHP $1,000 Use After Free Vulnerability in unserialize() with SplObjectStorage CVE-2015-6834
PHP $1,000 Use After Free Vulnerability in unserialize() with SplDoublyLinkedList CVE-2015-6834
Python $500 Python 3.3 - 3.5 product_setstate() Out-of-bounds Read
Ruby $1,500 Request Hijacking Vulnerability In RubyGems 2.4.6 And Earlier CVE-2015-3900
Python $500 Integer overflow in _Unpickler_Read
Apache httpd $500 mod_lua: Crash in websockets PING handling CVE-2015-0228
PHP $500 Null pointer dereference in phar_get_fp_offset() CVE-2015-7803
HackerOne $2,500 CSRF possible when SOP Bypass/UXSS is available
Shopify $500 Open Redirect at *.myshopify.com/account/login?checkout_url=
Shopify $500 [CSRF] Install premium themes
Algolia $100 Stored XSS in name selection
ok.ru $500 Обход защиты от csrf-ок в m.ok.ru
withinsecurity $250 content injection
ok.ru $500 Same-Origin Policy Bypass #2
ok.ru $500 Same-Origin Policy bypass on main domain - ok.ru
Zendesk $500 [CRITICAL] CSRF leading to account take over
Sucuri $250 XSS Vuln in Sucuri Security - Auditing, Malware Scanner
Binary.com $75 Cookie bug
Shopify $500 Open redirect using theme install
Ubiquiti Networks $200 account.ubnt.com CSRF
Shopify $500 XSS in creating tweets
Maximum $20 RC4 cipher suites detected
Maximum $10 SSL certificate invalid date
Maximum $40 RC4 cipher suites detected
Automattic $75 Remove anyone's pic gravtar
Pornhub $250 Reflected Cross-Site Scripting on French subdomain
Twitter $140 Subdomain Expired
InVision $300 Stored Cross-Site Scripting on █████████ (with small user interaction)
Uber $500 Drivers can change profile picture
Shopify $500 An administrator without any permission is able to get order notifications using his APNS Token.
Twitter $560 xss in link items (mopub.com)
Yelp $1,500 Access to internal CMS containing private Data
Imgur $5,500 Imgur dev environments facing the Internet
Twitter $560 URGENT : NICHE.co Account Take Over Vulnerability
Coinbase $5,000 Stored-XSS in https://www.coinbase.com/
Twitter $560 Add tweet to collection CSRF
Pornhub $250 Cross Site Scripting - On Mouse Over, Blog page
Pornhub $250 [xss, pornhub.com] /user/[username], multiple parameters
HackerOne $1,000 Pre-generation of 2FA secret/backup codes seems like an unnecessary risk
QIWI $100 Open Redirect in meeting.qiwi.com
Coinbase $500 Transactions visible on Unconfirmed devices
Algolia $200 User with limited access to Index configuration can rename the Index
drchrono $100 Request Accepts without X-CSRFToken [ Header - Cookie ]
HackerOne $500 Limited CSRF bypass.
drchrono $100 CSRF Add Album On onpatient.com
Boozt Fashion AB $100 Reflected XSS on www.boozt.com
Badoo $153 Open redirect helps to steal Facebook access_token
Uber $1,000 Mass Assignment Vulnerability in partners.uber.com
Shopify $500 deleted staff member can add his amazon marketplace web services account to the store.
Algolia $100 an xss issue
Shopify $500 [CSRF] Activate PayPal Express Checkout
QIWI $3,137 XML External Entity (XXE) in qiwi.com + waf bypass
Mapbox $1,000 XSS in L.mapbox.shareControl in mapbox.js
Slack $100 RC4 cipher suites detected on status.slack.com
Shopify $1,000 S3 Buckets open to the world thanks to 'Authenticated Users' ACL
Shopify $500 Apps can access 'channels' beta api
Binary.com $50 Email Verification Link can be Used as Password Reset Link!
Twitter $280 Urgent : Disclosure of all the apps with hash ID in mopub through API request (Authentication bypass)
QIWI $200 XSS Reflected in test.qiwi.ru
Shopify $1,500 'Limited' RCE in certain places where Liquid is accepted
Binary.com $300 login to any user's cashier account and full account information disclosure
itBit Exchange $100 No password length restriction denial of service
Algolia $100 Stored XSS on https://www.algolia.com/realtime-search-demo/*
HackerOne $2,500 Cross-domain AJAX request
Imgur $150 XSS m.imgur.com
Slack $100 Reflected Self-XSS in Slack
Twitter $1,120 File Upload XSS in image uploading of App in mopub
Slack $200 File upload XSS (Java applet) on http://slackatwork.com/
Shopify $500 List of devices is accessible regardless of the account limitations
Twitter $280 Following a User After Favoriting Actually Follows Another User (related to #95243)
Shopify $500 SVG parser loads external resources on image upload
Shopify $500 Staff members with no permission can access to the files, uploaded by the administrator
Mail.Ru $300 Potential SSRF in sales.mail.ru
ok.ru $250 Multiple critical vulnerabilities in Odnoklassniki Android application
HackerOne $1,000 HTTP header injection in info.hackerone.com allows setting cookies for hackerone.com
HackerOne $2,500 Send AJAX request to external domain
Twitter $1,120 Can see private tweets via keyword searches on tweetdeck
Shopify $500 An administrator without the 'Settings' permission is able to see payment gateways
Shopify $500 A 'Full access' administrator is able to see the shop owners user details
Shopify $500 Staff members with no permission to access domains can access them.
Keybase $50 Un-handled exception leads to Information Disclosure
Badoo $310 crossdomain.xml too permissive on eu1.badoo.com, us1.badoo.com, etc.
Snapchat $1,500 Password Reset - query param overrides postdata
Shopify $500 Missing of csrf protection
Imgur $50 Persistent XSS in https://p.imgur.com/albumview.gif and http://p.imgur.com/imageview.gif / post statistics
Slack $500 Stored XSS in Slack (weird, trial and error)
Vimeo $250 XSS on player.vimeo.com without user interaction and vimeo.com with user interaction
Binary.com $75 Http Response Splitting - Validate link
itBit Exchange $50 user-agent Content spoofing
Mail.Ru $300 [api.allodsteam.com] Authentication Data
Binary.com $50 Cross Site Scripting
Shopify $500 Privilege escalation and circumvention of permission to limited access user
Imgur $250 Persistent XSS in image title
Twitter $280 CSRF on cards API
Twitter $5,040 IDOR- Activate Mopub on different organizations- steal api token- Fabric.io
Shopify $500 Unauthorized access to any Store Admin's First & Last name
Twitter $280 Following a User Actually Follows Another User
Twitter $280 XSS in the "Poll" Feature on Twitter.com
Shopify $500 Reflected XSS in cart at hardware.shopify.com
Shopify $4,000 Paid account can review\download any invoice of any other shop
Whisper $30 SMS Invite Form Abuse
Whisper $30 Host Header Injection/Redirection
Shopify $500 Some S3 Buckets are world readable (and one is world writeable)
Zopim $1,000 Cross-site Scripting in all Zopim
Shopify $1,500 Arbitrary read on s3://shopify-delivery-app-storage/files
Shopify $2,500 Unauthorized access to all collections, products, pages from other stores
Shopify $500 Bypassing password requirement during deletion of accout
Shopify $2,000 Arbitrary write on s3://shopify-delivery-app-storage/files
Shopify $500 Missing authorization check on dashboard overviews
Shopify $500 get users information without full access
Shopify $1,000 Unauthenticated access to details of hidden products in any shop via title emuneration
Shopify $500 First & Last Name Disclosure of any Shopify Store Admin
WePay $100 Subdomain Takeover in http://staging.wepay.com/ pointing to Fastly
VK.com $100 Способ узнать имя человека и ВУЗ удаленной страницы
Shopify $2,000 unauthorized access to all collections name
Coinbase $100 SPF records not found
Shopify $500 Accessing Payments page and adding payment methods with limited access accounts
Badoo $456 Tokens from services like Facebook can be stolen
Shopify $2,500 unauthorized access to all customers first and last name
Automattic $75 CSV Injection in polldaddy.com
Trello $128 CSV Injection
Shopify $500 customers password hash leak!!!!
Uber $100 Issue with Password reset functionality
Trello $256 Normal User can add new users to group
Imgur $1,600 Server Side Request Forgery In Video to GIF Functionality
Imgur $50 Crossdomain.xml settings on api.imgur.com too open
Automattic $50 WooCommerce: Support Ticket indirect object reference
Imgur $50 Reflected Flash XSS using swfupload.swf with an epileptic reloading to bypass the button-event
Imgur $50 "Sign me out everywhere" does not work for desktop sessions
IRCCloud $500 Inadequate input validation on API endpoint leading to self denial of service and increased system load.
Zendesk $50 Content Spoofing
Shopify $1,000 change Login Services settings without owner access
Shopify $1,000 create staff member without owner access
Shopify $500 Privilege escalation vulnerability
Coinbase $100 User email enumuration using Gmail
Zopim $100 CSV Excel Macro Injection Vulnerability in export chat logs
Twitter $280 Tweetdeck (twitter owned app) not revoked
VK.com $500 CSRF в получении резервных токенов+framing , приводящие к компроментации 2fa
Zendesk $100 CSV Excel Macro Injection Vulnerability in export customer tickets
Zendesk $100 Cross-site Scripting https://www.zendesk.com/product/pricing/
Slack $100 Self-XSS in posts by formatting text as code
Mail.Ru $500 XSS: https://light.mail.ru/compose, https://m.mail.ru/compose/[id]/reply при ответе на специальным образом сформированное письмо
Twitter $2,520 Multiple DOMXSS on Amplify Web Player
Vimeo $200 XSS when using captions/subtitles on video player based on Flash (requires user interaction)
Phabricator $300 Information leakage through Graphviz blocks
Vimeo $100 XSS on vimeo.com | "Search within these results" feature (requires user interaction)
Vimeo $1,500 XSS on vimeo.com/home after other user follows you
Udemy $100 XSS Vulnerability
Vimeo $200 Stored XSS on vimeo.com and player.vimeo.com
Coinbase $100 OAUTH pemission set as true= lead to authorize malicious application
ownCloud $25 Full Path Disclosure CVE-2016-1501
Shopify $500 www.shopify.com XSS on blog pages via sharing buttons
Twitter $2,520 XSS on OAuth authorize/authenticate endpoint
Keybase $500 [keybase.io] Open Redirect
Anghami $100 [CRITICAL] Login To Any Account Linked With Google+ With Email Only
Anghami $300 [https://www.anghami.com/updatemailinfo/] Sql Injection
Phabricator $450 Multiple so called 'type juggling' attacks. Most notably PhabricatorUser::validateCSRFToken() is 'bypassable' in certain cases.
Romit $250 IDOR on remoing Share
Vimeo $100 Reflected XSS on vimeo.com/musicstore
Vimeo $500 Stored XSS on player.vimeo.com
Mail.Ru $150 XSS at af.attachmail.ru
InVision $400 Deleting a Project for which the user is not owner but a normal member
Shopify $500 XSS https://www.shopify.com/signup
ownCloud $25 Full Path Disclosure CVE-2016-1501
Zopim $100 [API ISSUE] agents can Create agents even after they are disabled !
InVision $100 Content Spoofing - Signout Warning Page
Pornhub $100 [reflected xss, pornhub.com] /blog, any
Pornhub $50 Cross Site Scripting – Album Page
Zendesk $500 Stored XSS in comments
Hired $420 Stored XSS in Company Name
Shopify $500 Self XSS in chat.
Automattic $100 XSS in WordPress
Gratipay $1 Possible SQL injection on "Jump to twitter"
Shopify $500 XSS https://delivery.shopifyapps.com/ (Digital Downloads App in myshopify.com)
Ruby on Rails $2,000 Potential XSS on sanitize/Rails::Html::WhiteListSanitizer
InVision $100 Reflective XSS in projects.invisionapp.com
HackerOne $500 Internal bounty and swag details disclosed as part of JSON response
HackerOne $500 Private Program and bounty details disclosed as part of JSON search response
HackerOne $500 Number of invited researchers disclosed as part of JSON search response
VK.com $500 Внедрение произвольного javascript-сценария в функционале просмотра изображений мобильной версии сайта
QIWI $500 Открытый доступ к корпоративным данным.
Slack $1,000 OSX slack:// protocol handler javascript injection
Flox $25 Content spoofing through Referel header
ok.ru $300 Доступ к чужим групповым беседам.
ok.ru $150 Critical : Access to group videos where videos are restricted for all users(Broken authentication )
Udemy $50 information disclosure
ok.ru $200 Доступ к чужим приватным фотографиям (3) через обложку видео
Mail.Ru $150 Time-Based Blind SQL Injection Attacks
ok.ru $500 (URGENT!) Покупка OK дешевле, чем он стоит
Mail.Ru $150 Cross site scripting
ok.ru $200 Stored XSS в имени песни (2) на платёжном гейте.
ok.ru $100 Покупка=>скачка песен, которые не предназначены для продажи
ok.ru $150 Покупка песни дешевле, чем она стоит.
ok.ru $150 xss in group
ok.ru $100 cross siite scripting in the blog
ok.ru $500 SSRF/XSPA в форме загрузки видео по URL
Shopify $1,000 TCP Source Port Pass Firewall
ok.ru $100 http://217.20.144.201 privilege escalation in apache tomcat SessionEample-script
Keybase $100 Full path disclosure at https://keybase.io/_/api/1.0/invitation_request.json
WordPoints $25 Weak Cryptographic Hash
Mavenlink $25 Open/Unvalidated Redirect Issue
Keybase $250 Content Sniffing not disabled
Romit $250 GA code not verified on the server side allows sending Verification Documents on behalf of another user
Keybase $250 No rate limiting for sensitive actions (like "forgot password") enables user enumeration
Keybase $500 Stealing CSRF Tokens
Keybase $500 SMTP protection not used
Zaption $25 Open redirect filter bypass
Zaption $25 Using GET method for account login with CSRF token leaking to external sites Via Referer.
Zaption $50 XSS - Gallery Search Listing
Zendesk $200 Stored Cross site scripting In developer.zendesk.com
Romit $250 No rate limit which leads to "Users information Disclosure" including verfification documents etc.
HackerOne $500 Accessing title of the report of which you are marked as duplicate
QIWI $100 Session Cookie without HttpOnly and secure flag set
Mapbox $500 Disclosure of map information
Zendesk $50 Error stack trace enabled
Romit $250 Potential for financial loss, negative Values for "Buy fee" and "Sell Fee"
Ubiquiti Networks $500 Yet another Buffer Overflow in PHP of the AirMax Products
Ubiquiti Networks $500 Other Buffer Overflow in PHP of the AirMax Products
Udemy $150 Extremely high Course rating values could be set in order to make really high Average rating of the course. Negative values could be set to.
Shopify $3,000 Attention! Remote Code Execution at http://wpt.ec2.shopify.com/
Shopify $500 Reflected XSS in chat
Ubiquiti Networks $250 Buffer Overflow in PHP of the AirMax Products
Ubiquiti Networks $18,000 Arbritrary file Upload on AirMax
Python $1,000 Integer overflow in _json_encode_unicode leads to crash
Python $500 Integer overflow in _pickle.c
Python $1,000 Python: imageop Unsafe Arithmetic
PHP $500 PHP yaml_parse/yaml_parse_file/yaml_parse_url Unsafe Deserialization
PHP $1,500 PHP yaml_parse/yaml_parse_file/yaml_parse_url Double Free
PHP $500 str_repeat() sign mismatch based memory corruption
Python $500 Multiple type confusions in unicode error handlers
Python $500 Use after free in get_filter
Python $1,500 Multiple use after free bugs in json encoding
Python $1,500 Multiple use after free bugs in heapq module
Python $1,500 Multiple use after free bugs in element module
Python $500 Tokenizer crash when processing undecodable source code
PHP $500 php_stream_url_wrap_http_ex() type-confusion vulnerability
PHP $500 Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER
PHP $500 Type Confusion Vulnerability in SoapClient
PHP $1,500 Use after free vulnerability in unserialize() with DateInterval
The Internet $3,000 libcurl: URL request injection CVE-2014-8150
OpenSSL $2,500 Malformed ECParameters causes infinite loop CVE-2015-1788
PHP $1,500 Integer overflow in ftp_genlist() resulting in heap overflow CVE-2015-4022
PHP $1,500 ZIP Integer Overflow leads to writing past heap boundary CVE-2015-2331
PHP $1,000 Buffer Over-read in unserialize when parsing Phar CVE-2015-2783
PHP $1,000 Buffer Over flow when parsing tar/zip/phar in phar_set_inode CVE-2015-3329
OpenSSL $500 X509_to_X509_REQ NULL pointer deref CVE-2015-0288
PHP $1,500 Use After Free Vulnerability in unserialize() CVE-2015-2787
PHP $500 out of bounds read crashes php-cgi CVE-2014-9427
HackerOne $500 CSV Injection with the CVS export feature
VK.com $300 Уязвимость Создание фотографий без ведома пользователей
Pornhub $5,000 Unauthenticated access to Content Management System - www1.pornhubpremium.com
Shopify $500 XSS at Bulk editing ProductVariants
Pornhub $2,500 Multiple endpoints are vulnerable to XML External Entity injection (XXE)
Pornhub $10,000 Publicly exposed SVN repository, ht.pornhub.com
Hired $250 URGENT - Subdomain Takeover on be.hired.com. due to unclaimed domain pointing to Heroku.com
Shopify $500 XSS in Myshopify Admin Site in DISCOUNTS
VK.com $250 Отвязываем Twitter от любого профиля вк ! + несколько багов по дизайну
Automattic $100 Verification code issues for Two-Step Authentication
VK.com $100 Issue in the implementation of captcha and race condition
Shopify $1,000 Bypass access restrictions from API
InVision $150 Enumeration and Guessable Email (OWASP-AT-002)T hrough Login Form
Shopify $500 SSRF via 'Insert Image' feature of Products/Collections/Frontpage
Mail.Ru $160 [my.mail.ru] CRLF Injection
Shopify $500 SSRF via 'Add Image from URL' feature
VK.com $200 Уязвимость получения всех номеров телефонов вк (по совместительству логинов профилей)
Shopify $500 Expire User Sessions in Admin Site does not expire user session in Shopify Application in IOS
Mail.Ru $200 Possible xWork classLoader RCE: shared.mail.ru
Shopify $500 XSS at Bulk editing products
Shopify $500 XSS at importing Product List
Sandbox Escape $3,000 Microsoft Internet Explorer ActiveX Broker Allows EPM Bypass
Legal Robot $20 - Guessing registered users in legalrobot.com
Shopify $500 [www.*.myshopify.com] CRLF Injection
Legal Robot $20 No valid SPF record
HackerOne $500 mailto: link injection on https://hackerone.com/directory
Mail.Ru $250 [s.mail.ru] CRLF Injection
VK.com $200 Уязвимость в Указание мест на фото + фича + хакинг
HackerOne $500 Invitation is not properly cancelled while inviting to bug reports.
VK.com $500 XSS at http://vk.com on IE using flash files
VK.com $400 Уязвимость приватных записей пользователя (личных)
Coinbase $5,000 OAuth authorization page vulnerable to clickjacking
Mail.Ru $150 Activities are not Protected and able to crash app using other app (Can Malware or third parry app).
VK.com $100 Не достаточная проверка логина скайп
Mapbox $1,000 Stored Cross-Site Scripting in Map Share Page
Legal Robot $20 CSRF
Coinbase $5,000 Big Bug with Vault which i have already reported: Case #606962
Mail.Ru $250 HTML Injection на e.mail.ru
VK.com $500 API: Bug in method auth.validatePhone
Legal Robot $40 Registration bypass using OAuth logical bug
VK.com $100 Able to intercept app Traffic after choosing up the Secured Connection using SSL (HTTPS)
Legal Robot $20 Missing security headers, possible clickjacking
Legal Robot $20 missing SPF for legalrobot.com
Shopify $1,000 Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using `Order Printer APP`
Romit $50 Cross site scripting
HackerOne $100 Potential denial of service in hackerone.com/<program>/reward_settings
HackerOne $500 Logic error with notifications: user that has left team continues to receive notifications and can not 'clean' this area on account
Mavenlink $100 XSS in https://app.mavenlink.com/workspaces/
HackerOne $500 External URL page bypass
Shopify $500 Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS
Udemy $150 Multiple sub domain are vulnerable because of leaking full path
Mail.Ru $150 http://tp-dev1.tp.smailru.net/
Mail.Ru $200 tt-mac.i.mail.ru: Quagga 0.99.23.1 (Router) : Default password and default enable password
Shopify $500 XSS in myshopify.com Admin site in TAX Overrides
Udemy $100 XSS on https://www.udemy.com/asset/export.html
Udemy $100 Ability to add pishing links in discusion ," Bypassing uneductional Links add "
Sandbox Escape $3,000 Internet Explorer Enhanced Protected Mode sandbox escape via a broker vulnerability
Udemy $150 leak receipt of another user
Udemy $100 xss on autoserch
Slack $100 Bypass of the SSRF protection (Slack commands, Phabricator integration)
Mail.Ru $400 http://fitter1.i.mail.ru/browser/ торчит Graphite в мир
Mail.Ru $400 store-agent.mail.ru: stacked blind injection
HackerOne $500 Content Spoofing - External Link Warning Page
Udemy $150 teach.udemy.com log poison vulnerability through wordpress debug.log being publically available
Udemy $150 xss profile
HackerOne $500 Reopen Disable Accounts/ Hidden Access After Disable
drchrono $100 Accessing all appointments vulnerability
drchrono $150 Create and Update patients vulnerability
HackerOne $500 Fake URL + Additional vectors for homograph attack
HackerOne $500 Homograph attack
HackerOne $500 Making any Report Failed to load
Dropbox $512 XSS in dropbox main domain
Dropbox $216 Race condition when redeeming coupon codes
Shopify $500 Stored XSS in the Shopify Discussion Forums
Shopify $500 SSL cookie without secure flag set
Shopify $500 Content Spoofing
HackerOne $500 Homograph attack
Whisper $50 Insecure Local Data Storage : Application stores data using a binary sqlite database
Romit $50 HTML injection in email sent by romit.io
Coinbase $100 ByPassing the email Validation Email on Sign up process in mobile apps
Romit $50 Server responds with the server error logs on account creation
Vimeo $500 API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass
Shopify $500 amazon aws s3 bucket content is public :- http://shopify.com.s3.amazonaws.com/
Shopify $500 XSS in experts.shopify.com
Twitter $280 DOM based cookie bomb
HackerOne $500 Open-redirect on hackerone.com
Shopify $4,000 Notification request disclose private information about other myshopify accounts
Dropbox $512 SSRF vulnerablity in app webhooks
Whisper $30 Missing DMARC record
Shopify $500 XSS on ecommerce.shopify.com
HackerOne $1,000 SPF whitelist of mandrill leads to email forgery
Shopify $500 Invitation issue
Shopify $500 Payment gateway status transferred to Shopify without authentication
Shopify $1,000 Shop admin can change external login services
Shopify $1,000 IDOR expire other user sessions
Dropbox Acquisitions $216 Get email ID of any user on hackpad.com
Shopify $2,000 Shopify android client all API request's response leakage, including access_token, cookie, response header, response body content
Shopify $500 CSRF token fixation in facebook store app that can lead to adding attacker to victim acc
Shopify $1,000 [persistent cross-site scripting] customers can target admins
Shopify $500 Force 500 Internal Server Error on any shop (for one user)
Twitter $280 Fabric.io: Ex-admin of an organization can delete team members
Shopify $500 Open Redirect after login at http://ecommerce.shopify.com
Shopify $500 Authentication Failed Mobile version
Shopify $500 Open redirection in OAuth
drchrono $700 XML Parser Bug: XXE over which leads to RCE
PHP $3,000 Use after free vulnerability in unserialize()
PHP $2,500 SoapClient's __call() type confusion through unserialize()
PHP $2,500 Use after free vulnerability in unserialize() with DateTimeZone
PHP $2,500 Free called on unitialized pointer in exif.c
OpenSSL $3,000 Segmentation fault for invalid PSS parameters
Python $9,000 Multiple Python integer overflows
Shopify $500 Missing spf flags for myshopify.com
Coinbase $1,000 Sandboxed iframes don't show confirmation screen
Mail.Ru $500 e.mail.ru stored XSS in agent via sticker (smile)
Snapchat $100 Captcha Bypass in Snapchat's Geofilter Submission Process
Snapchat $100 Vulnerable to JavaScript injection. (WXS) (Javascript injection)!
Slack $100 Logout any user of same team
Mapbox $1,000 Persistent cross-site scripting (XSS) in map attribution
Shopify $500 Xss in website's link
Twitter $420 Insecure Direct Object Reference - access to other user/group DM's
Twitter $2,800 HTTP Response Splitting (CRLF injection) due to headers overflow
Mapbox $1,000 Stored xss in editor
Dropbox Acquisitions $216 XSS in https://hackpad.com/
Twitter $1,400 XSS in twitter.com/safety/unsafe_link_warning
Phabricator $300 SSRF vulnerability (access to metadata server on EC2 and OpenStack)
Coinbase $100 Blacklist bypass on Callback URLs
Vimeo $250 [URGENT ISSUE] Add or Delete the videos in watch later list of any user .
Phabricator $300 XSS with Time-of-Day Format
Vimeo $250 Share your channel to any user on vimeo without following him
Vimeo $250 Invite any user to your group without even following him
Twitter $420 Insecure direct object reference - have access to deleted DM's
itBit Exchange $200 secretKey for OTP , is getting leaked in response of a delete request !
itBit Exchange $200 confirmation bypass of 2FA devices while they are deleting
Ubiquiti Networks $500 UniFi v3.2.10 Cross-Site Request Forgeries / Referer-Check Bypass
Vimeo $150 Insecure Direct Object References that allows to read any comment (even if it should be private)
Vimeo $500 Insecure Direct Object References in https://vimeo.com/forums
Twitter $3,500 HTTP Response Splitting (CRLF injection) in report_story
HackerOne $500 Open redirect in "Language change".
Caviar $500 Remotely modifying courier Account Details
Vimeo $250 Post in private groups after getting removed
Flash $2,000 Flash Cross Domain Policy Bypass by Using File Upload and Redirection - only in Chrome
Vimeo $250 A user can enhance their videos with paid tracks without buying the track
Whisper $10 CVE-2014-0224 openssl ccs vulnerability
Whisper $100 Bypass pin(4 digit passcode on your android app)
Vimeo $500 A user can post comments on other user's private videos
Vimeo $250 A user can add videos to other user's private groups
Vimeo $250 A user can edit comments even after video comments are disabled
Twitter $560 open redirect sends authenticity_token to any website or (ip address)
Ubiquiti Networks $500 CSRF in login form would led to account takeover
The Internet $7,500 FREAK: Factoring RSA_EXPORT Keys to Impersonate TLS Servers
Twitter $1,400 XSS in original referrer after follow
Romit $50 The csrf token remains same after user logs in
Ruby on Rails $1,000 rails-ujs will send CSRF tokens to other origins
Twitter $560 Twitter Ads Campaign information disclosure through admin without any authentication.
Twitter $1,400 Open Redirect leak of authenticity_token lead to full account take over.
HackerOne $5,000 Improperly validated fields allows injection of arbitrary HTML via spoofed React objects
Vimeo $250 Vimeo + & Vimeo PRO Unautorised Tax bypass
Mail.Ru $300 RCE через JDWP
Yelp $500 Information disclosure - emails disclosed in response > staging.seatme.us
Mail.Ru $150 scfbp.tng.mail.ru: Heartbleed
Mail.Ru $150 HDFS NameNode Public disclosure: http://185.5.139.33:50070/dfshealth.jsp
Todoist $25 Remotely removing credit cards from business accounts!
Todoist $25 Taking over a Business Account Admin
Twitter $1,400 Redirect URL in /intent/ functionality is not properly escaped
HackerOne $500 Team member invitations to sandboxed teams are not invalidated consistently (v2)
The Internet $5,000 Bad Write in TTF font parsing (win32k.sys)
Coinbase $100 open authentication bug
Slack $200 Team admin can add billing contacts
Dropbox Acquisitions $729 Privilege Escalation at invite feature @hackpad.com
Twitter $140 Reporting user's profile by using another people's ID
The Internet $3,000 Heap overflow in H. Spencer’s regex library on 32 bit systems
Romit $50 Email Enumeration (POC)
QIWI $200 [ishop.qiwi.com] XSS + Misconfiguration
Mail.Ru $600 Same Origin Policy bypass
HackerOne $2,000 CSP Bypass: Click handler for links with data-method="post" can cause authenticity_token to be sent off domain
Flash $7,500 Use After Free in Flash MessageChannel.send can cause arbitrary code execution
Flash $10,000 Use after free during the StageVideoAvailabilityEvent can result in arbitrary code execution
Flash $10,000 Race condition in workers may cause an exploitable double free by abusing bytearray.compress()
InVision $200 Javascript Injection
itBit Exchange $50 Leakage of sensitive wallet tokens to third party sites
Flash $2,000 Adobe Flash Player Out-of-Bound Access Vulnerability
Vimeo $250 Red October 1511493148.cloud.vimeo.com
HackerOne $5,000 Markdown parsing issue enables insertion of malicious tags and event handlers
Twitter $560 Twitter Card - Parent Window Redirection
Slack $100 Team admin can change unauthorized team setting (allow_message_deletion)
Slack $200 Team admin can change unauthorized team setting (require_at_for_mention)
Romit $50 Frictionless Transferring of Wallet Ownership
Twitter $1,260 Problem with OAuth
HackerOne $500 Team member invitations to sandboxed teams are not invalidated consistently
HackerOne $500 Insecure Direct Object Reference vulnerability
Whisper $10 Error stack trace
Whisper $25 Directory index and information disclosure
HackerOne $5,000 Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered
Vimeo $250 CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`.
Trello $128 [blog.trello.com] CRLF Injection
Trello $64 [trello.com] Open Redirect
Vimeo $100 XSS on Vimeo
itBit Exchange $150 Stored xss in bank name withdraw
Vimeo $100 ftp upload of video allows naming that is not sanitized as the manual naming
itBit Exchange $50 weird bug ! ( missing validation on new email verfication )
HackerOne $500 Improper way of validating a program
itBit Exchange $200 Unsecure data in "device" response - OTP
Vimeo $100 Vimeo Search - XSS Vulnerability [http://vimeo.com/search]
Twitter $140 Insecure Data Storage in Vine Android App
itBit Exchange $50 Email Length Verification
itBit Exchange $500 Notification Emails: IP + Content-Spoofing
Ruby on Rails $500 RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1
Vimeo $1,000 XSS on any site that includes the moogaloop flash player | deprecated embed code
Twitter $140 Flaw in login with twitter to steal Oauth tokens
Mail.Ru $150 Heartbleed: my.com (185.30.178.33) port 1433
Vimeo $1,000 Make API calls on behalf of another user (CSRF protection bypass)
Mail.Ru $150 Hadoop Node available to public
Vimeo $100 CRITICAL full source code/config disclosure for Cameo
Twitter $420 twitter android app Fragment Injection
Vimeo $1,000 abusing Thumbnails(https://vimeo.com/upload/select_thumb) to see a private video
Vimeo $250 Ability to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`)
Mail.Ru $100 Раскрытие номера мобильного телефона при двухфакторной аутентификации
Vimeo $100 player.vimeo.com - Reflected XSS Vulnerability
Vimeo $1,000 Adding profile picture to anyone on Vimeo
Vimeo $260 Buying ondemand videos that 0.1 and sometimes for free
Python $1,000 PyUnicode_FromFormatV crasher
Ruby on Rails $1,000 Arbitrary file existence disclosure in Action Pack CVE-2014-7829
Twitter $1,120 Fabric.io - an app admin can delete team members from other user apps
Twitter $1,400 fabric.io - app member can make himself an admin
Vimeo $100 APIs for channels allow HTML entities that may cause XSS issue
Vimeo $5,000 Vimeo.com Insecure Direct Object References Reset Password
Vimeo $100 Vimeo.com - reflected xss vulnerability
Vimeo $100 Vimeo.com - Reflected XSS Vulnerability
Uber $500 XSS on partners.uber.com
Flash $1,000 chrome allows POST requests with custom headers using flash + 307 redirect
Twitter $420 URGENT - Subdomain Takeover on users.tweetdeck.com , the same issue of report #32825
Romit $250 stored xss in transaction
Twitter $1,400 HTML/XSS rendered in Android App of Crashlytics through fabric.io
Romit $250 Stored XSS in api key of operator wallet
Romit $100 Error stack trace
Twitter $140 POODLE Bug: 199.16.156.44, 199.16.156.108, mx4.twitter.com
Twitter $280 Open redirection in fabric.io
Mail.Ru $100 No bruteforce protection leads to enumeration of emails in http://e.mail.ru/
Phabricator $500 Phabricator Phame Blog Skins Local File Inclusion
Vimeo $500 [vimeopro.com] CRLF Injection
Phabricator $300 Phabricator Diffusion application allows unauthorized users to delete mirrors
Square $500 Delayed, fraudulent transactions possible with encrypted Square Reader devices due to lack of server-side verification of device transaction counter
Mail.Ru $250 [connect.mail.ru] Memory Disclosure / IE XSS
HackerOne $500 Issue with password change
HackerOne $500 Breaking Bugs as team member
Openfolio $100 xss in /browse/contacts/
Python $6,500 Misc Python bugs (Memory Corruption & Use After Free)
QIWI $150 [qiwi.com] Open Redirect
QIWI $100 Stored xss in agent.qiwi.com
Greenhouse.io $1,000 Subdomain Takeover using blog.greenhouse.io pointing to Hubspot
Eobot $10 XSS in www.eobot.com(IE9 only)
Sucuri $250 Open Redirect in unmask.sucuri.net
InVision $150 CSRF Token in cookies!
Twitter $1,400 [Stored XSS] vine.co - profile page
Coinbase $100 New Device Confirmation, token is valid until not used.
QIWI $1,000 [send.qiwi.ru] Soap-based XXE vulnerability /soapserver/
QIWI $100 [qiwi.com] /oauth/confirm.action XSS
Flash $2,000 Adobe Flash Player MP4 Use-After-Free Vulnerability
Apache httpd $500 mod_proxy_fcgi buffer overflow CVE-2014-3583
HackerOne $500 Logic Issue with Reputation: Boost Reputation Points
QIWI $250 CRLF Injection [ishop.qiwi.com]
QIWI $200 [send.qiwi.ru] XSS at auth?login=
QIWI $200 [static.qiwi.com] XSS proxy.html
Twitter $140 getting emails of users/removing them from victims account [using typical attack]
HackerOne $500 Gain reputation by creating a duplicate of an existing report
PHP $2,500 Locale::parseLocale Double Free
Twitter $280 XSS via Fabrico Account Name
Mail.Ru $500 Ошибка фильтрации
Block.io $150 SMPT Protection not used, I can hijack your email server.
Twitter $420 Bad extended ascii handling in HTTP 301 redirects of t.co
HackerOne $500 File Name Enumeration
Twitter $1,400 DOM Cross-Site Scripting ( XSS )
InVision $300 Backup of wordpress configuration file found. Leaking database users/passwords
Slack $500 a stored xss in slack integration https://onerror.slack.com/services/import
Twitter $1,680 URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWS
Mail.Ru $200 OpenSSL HeartBleed (CVE-2014-0160)
Twitter $280 XSS in fabric.io
The Internet $3,000 Drupal 7 pre auth sql injection and remote code execution
Twitter $140 Singup Page HTML Injection Vulnerability
RelateIQ $500 PoodleBleed
Flash $5,000 Adobe Flash Player Out-of-Bound Read/Write Vulnerability
HackerOne $1,000 Ability to see common response titles of other teams (limited)
WP API $50 Cryptographic Side Channel in OAuth Library
Twitter $420 Unauthorized Tweeting on behalf of Account Owners
Twitter $560 Improper Verification of email address while saving Account Settings
RelateIQ $250 Relateiq SSLv3 deprecated protocol vulnerability.
Flash $2,000 Adobe Flash Player MP4 Use-After-Free Vulnerability
Coinbase $100 New Device confirmation tokens are not properly validated.
Square $250 CSRF on adding a calendar event
Square $500 square google calendar integration CSRF,https://squareup.com/appointments/business/settings(state parameter not checking properly)
Square $500 CSRF on adding clients
The Internet $20,000 GNU Bourne-Again Shell (Bash) 'Shellshock' Vulnerability
Twitter $280 Profile Pic padding (Length-hiding) fails due to use of GZIP
HackerOne $500 homograph attack. IDNs displayed in unicode in bug reports and on external link warning page
IRCCloud $300 Unvalidated Channel names causes IRC Command Injection
Square $250 Privilege Escalation
WePay $350 Horizontal Privilege Escalation
Twitter $1,120 XSS platform.twitter.com | video-js metadata
HackerOne $500 No email verification on username change
Twitter $1,120 XSS platform.twitter.com
Sucuri $250 Usage of HTTP for exporting graph data as images
Square $250 Redirect while opening link in new tabs
Coinbase $100 Credit Card Validation Issue
HackerOne $500 Redirect FILTER bypass in report/comment
Mail.Ru $500 touch.mail.ru XSS via message id
Twitter $420 iOS App can establish Facetime calls without user's permission
Ruby on Rails $1,500 Active Record SQL Injection Vulnerability Affecting PostgreSQL CVE-2014-3483
Ruby on Rails $1,500 Active Record SQL Injection Vulnerability Affecting PostgreSQL CVE-2014-3482
PHP $2,500 SPL ArrayObject/SPLObjectStorage Unserialization Type Confusion Vulnerabilities CVE-2014-3515
Twitter $1,400 Cross site scripting on ads.twitter.com
HackerOne $500 Window Opener Property Bug
Twitter $1,400 Stored xss
Square $2,000 malicious file upload
Flash $1,000 Flash Local Sandbox Bypass CVE-2014-0554
Twitter $1,400 ads.twitter.com xss
Square $400 Reflected XSS in widget script thru cookie
Twitter $2,800 Delete Credit Cards from any Twitter Account in ads.twitter.com [New Vulnerability]
Square $1,000 Reflected XSS in connect.square.com
Square $750 Editing Client Details of other People
Twitter $140 Missing Rate Limiting on https://twitter.com/account/complete
The Internet $3,000 open redirect in rfc6749
Mail.Ru $1,337 XSS via .eml file
WePay $350 Critical : Account removing using CSRF attack
Twitter $140 Full path disclosure at ads.twitter.com
Square $2,000 CRITICAL Account takeover via AngularJS template injection in connect.squareup.com
Django $1,000 CSRF protection bypass on any Django powered site via Google Analytics
Square $500 XSS in Client Past Activity
Square $250 Open Redirect [FreshBook]
Square $500 XSS [BookFresh]
HackerOne $100 Change Any username and profile link in hackerone
Phabricator $400 Open redirection on secure.phabricator.com
Mail.Ru $150 money.mail.ru: Странное поведение SMS
HackerOne $500 Redirect while opening links in new tabs
Phabricator $300 Forgot Password Issue
Square $1,500 Blind SQL injection in www.bookfresh.com
Slack $200 Content Spoofing all Integrations in https://team.slack.com/services/new/
Slack $100 Content spoofing at Stripe Integrations
Mavenlink $50 privilege escalation
Mavenlink $200 Flash XSS on swfupload.swf showing at app.mavenlink.com
Mavenlink $50 Clickjacking
Mavenlink $100 Login CSRF
Coinbase $1,000 Invoice Details activate JS that filled in
The Internet $3,000 rsync hash collisions may allow an attacker to corrupt or modify files
Apache httpd $500 moderate: mod_deflate denial of service CVE-2014-0118
Mail.Ru $150 cloud.mail.ru: File upload XSS using Content-Type header
Python $1,500 integer overflow in 'buffer' type allows reading memory
Mail.Ru $1,000 e.mail.ru: File upload "Chapito" circus
Mail.Ru $100 m.agent.mail.ru: Подделываем j2me app-descriptor
RelateIQ $100 Cross-site Scripting in mailing (username)
Mail.Ru $3,000 Possibility to attach any mobile number to any email
Sandbox Escape $5,000 .NET Type Traversal Vulnerability CVE-2014-0257
WePay $100 Unauthorized Access via Join Email Link
DC Compendium $25 Multiple Full Path Disclosure (FPD) Vulnerability on Dccompendium.com domain
RelateIQ $190 Resubmitted with POC #18685 Password reset CSRF
Phabricator $1,000 XSS in editor by any user
WePay $150 CSRF on email address operations. Also performing unintended operations.
WePay $500 Session Fixation
DC Compendium $50 Backend source code disclosure on 404 pages
DC Compendium $25 source code disclosure
Yahoo! $250 Yahoo! Reflected XSS
DC Compendium $25 XSS on Home page
DC Compendium $25 Error page Cross-site scripting
DC Compendium $25 Clickjacking: X-Frame-Options header missing
HackerOne $100 Denial of Service
The Internet $6,000 LZ4 Core CVE-2014-4611
IRCCloud $500 Reflected XSS in Pastebin-view
Yahoo! $50 Default /docs folder of PHPBB3 installation on gamesnet.yahoo.com
Phabricator $300 Broken Authentication and Session Management
HackerOne $100 Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met)
Slack $100 Password Policy issue (Weak Protect)
Mail.Ru $400 e.mail.ru: SMS spam with custom content
Slack $100 Open Redirect login account
RelateIQ $250 SSRF (Portscan) via Register Function (Custom Server)
RelateIQ $200 Failed Certificate Validation On Custom Server (Register)
Yahoo! $200 Yahoo Sports Fantasy Golf (Join Public Group)
Phabricator $300 Abusing daemon logs for Privilege escalation under certain scenarios
The Internet $5,000 Multiple issues in looking-glass software (aka from web to BGP injections)
Phabricator $600 Abusing VCS control on phabricator
Mavenlink $50 Non Validation of session after password reset
HackerOne $100 Session not invalidated after password reset
Mail.Ru $150 SQL Injection on 11x11.mail.ru
Coinbase $1,000 Leaking CSRF token over HTTP resulting in CSRF protection bypass
Flash $3,000 Flash Sandbox Bypass CVE-2014-0535
Mavenlink $100 Password reset token not expiring
WePay $300 Open Redirect
Mavenlink $50 Clickjacking at https://www.mavenlink.com/ main website
Mavenlink $50 Login password guessing attack
WePay $100 Session fixation in wepay.com
Slack $300 SSRF on https://whitehataudit.slack.com/account/photo
Mail.Ru $300 connect.mail.ru: SSRF
Automattic $250 privilege escalation
HackerOne $100 Potential denial of service in hackerone.com/teams/new
Mail.Ru $1,000 https://217.69.135.63/rb/: money.mail.ru sources disclosure
Sandbox Escape $10,000 Linux PI futex self-requeue bug CVE-2014-3153
IRCCloud $100 Host Header Injection - irccloud.com
Mail.Ru $500 auth.mail.ru: XSS in login form
Yahoo! $100 Testing for user enumeration (OWASP‐AT‐002) - https://gh.bouncer.login.yahoo.com
Yahoo! $50 Authorization issue on creative.yahoo.com
Mail.Ru $500 XSS in a file or folder name
Mail.Ru $700 XXE and SSRF on webmaster.mail.ru
Flash $7,500 Adobe Flash Player FileReference Use-after-Free Vulnerability CVE-2014-0538
Python $1,500 Python vulnerability: reading arbitrary process memory CVE-2014-4616
Mail.Ru $150 Stored XSS on http://cards.mail.ru
Mail.Ru $300 Stored XSS on http://top.mail.ru
Mail.Ru $250 SQL injection update.mail.ru
Yahoo! $250 Infrastructure and Application Admin Interfaces (OWASP‐CM‐007)
Mail.Ru $400 XSS in https://e.mail.ru/cgi-bin/lstatic (Limited use)
Coinbase $100 CSRF in function "Set as primary" on accounts page
99designs $400 report a reflected XSS
Coinbase $100 CSRF on "Set as primary" option on the accounts page
Coinbase $1,000 Bypassing 2FA for BTC transfers
Mail.Ru $150 SQL inj
The Internet $3,000 Bypassing Same Origin Policy With JSONP APIs and Flash
Slack $500 Stored XSS in slack.com (integrations)
Mail.Ru $150 SQL
Mail.Ru $150 SQL inj
HackerOne $100 All Active user sessions should be deleted when user change his password!
Mail.Ru $200 Time based sql injection
Mail.Ru $200 SQL injection [дырка в движке форума]
Slack $500 Stored XSS Found
HackerOne $100 Anti-MIME-Sniffing header X-Content-Type-Options header has not been set.
Ian Dunn $25 Xss in CampTix Event Ticketing
Ian Dunn $25 Stored XSS in all fields in Basic Google Maps Placemarks Settings
Mail.Ru $250 Home page reflected XSS
Mail.Ru $150 localStorage не чистится после выхода
Mail.Ru $150 Clickjacking
Yahoo! $300 information disclosure (LOAD BALANCER + URI XSS)
Yahoo! $500 https://caldav.calendar.yahoo.com/ - XSS (STORED)
HackerOne $100 Password Reset Bug
HackerOne $150 Issue with remember_user_token
Yahoo! $250 readble .htaccess + Source Code Disclosure (+ .SVN repository)
Flash $2,000 Security bypass could lead to information disclosure
Yahoo! $2,500 Local File Include on marketing-dam.yahoo.com
Yahoo! $400 invite1.us2.msg.vip.bf1.yahoo.com/ - CSRF/email disclosure
IRCCloud $100 Login CSRF can be bypassed (Similar approach to previous one).
IRCCloud $1,000 Dangerous Persistent xss
Coinbase $100 2 factor authentication design flaw
IRCCloud $100 Host Header is not validated resulting in Open Redirect
The Internet $7,500 TLS Triple Handshake Attack
Yahoo! $500 XSS in https://hk.user.auctions.yahoo.com
Yahoo! $250 Bypass of the Clickjacking protection on Flickr using data URL in iframes
IRCCloud $500 Persistent Cross Site Scripting within the IRCCloud Pastebin
IRCCloud $100 iOS application does not destroy session upon logout.
IRCCloud $100 Bug in iOS application which could lead to unauthorised access.
IRCCloud $100 Missing X-Content-Type-Options
IRCCloud $500 Full account takeover using CSRF and password reset
IRCCloud $500 Session Token is not Verified while changing Account Setting's which Result In account Takeover
IRCCloud $100 Leaking Referrer in Reset Password Link
IRCCloud $100 Bruteforcing irccloud login
IRCCloud $100 Unsecure cookies, cookie flag secure not set
IRCCloud $100 Sign up CSRF
IRCCloud $100 Login CSRF
Yahoo! $2,000 Open Proxy, http://www.smushit.com/ysmush.it/, 4/09/14, #SpringClean
Yahoo! $200 CSRF Token is missing on DELETE message option on http://baseball.fantasysports.yahoo.com/b1/127146/messages
Yahoo! $400 CSRF Token missing on http://baseball.fantasysports.yahoo.com/b1/127146/messages
Yahoo! $3,000 REMOTE CODE EXECUTION/LOCAL FILE INCLUSION/XSPA/SSRF, view-source:http://sb*.geo.sp1.yahoo.com/, 4/6/14, #SpringClean
Yahoo! $500 Comment Spoofing at http://suggestions.yahoo.com/detail/?prop=directory&fid=97721
Python $1,500 Integer overflow in strop.expandtabs
Flash $2,000 Same Origin Security Bypass Vulnerability CVE-2014-0503
RelateIQ $100 Wildcard DNS in website
HackerOne $150 creating titleless and non-closable bugs
Yahoo! $1,000 Header injection on rmaitrack.ads.vip.bf1.yahoo.com
Yahoo! $250 Cross-origin issue on rmaiauth.ads.vip.bf1.yahoo.com
Yahoo! $300 reflected XSS, http://extprodweb11.cc.gq1.yahoo.com/, 4/8/14, #SpringClean
Yahoo! $500 Significant Information Disclosure/Load balancer access, http://extprodweb11.cc.gq1.yahoo.com/, 4/8/14, #SpringClean
InVision $200 captcha missing
Slack $500 Facebook Takeover using Slack using 302 from files.slack.com with access_token
Slack $300 Stored XSS in Slack.com
HackerOne $100 Marking notifications as read CSRF bug
Coinbase $1,000 Multiple Issues related to registering applications
The Internet $500 Uncontrolled Resource Consumption with XMPP-Layer Compression
Coinbase $100 Coinbase Android Security Vulnerabilities
Yahoo! $100 XSS in Yahoo! Web Analytics
Coinbase $1,000 Coinbase Android Application - Bitcoin Wallet Leaks OAuth Response Code
Yahoo! $800 From Unrestricted File Upload to Remote Command Execution
Nginx $3,000 SPDY heap buffer overflow CVE-2014-0133
Nginx $3,000 SPDY memory corruption CVE-2014-0088
Slack $500 Duplicate of #4550
Slack $500 Stored XSS in Slackbot Direct Messages
Yahoo! $500 Server Side Request Forgery
RelateIQ $100 TRACE disclosure attack may be possible
Yahoo! $250 XSS Vulnerability (my.yahoo.com)
Phabricator $300 Persistent XSS: Editor link
HackerOne $100 Securing sensitive pages from SearchBots
Phabricator $400 OAuth Stealing Attack (New)
Phabricator $300 Control character allowed in username
Phabricator $450 OAuth access_token stealing in Phabricator
Slack $500 flash content type sniff vulnerability in api.slack.com
RelateIQ $100 Captcha Bypass With Extension
Ruby on Rails $1,500 Directory traversal attack in view resolver CVE-2014-0130
Phabricator $300 UnAuthorized Editorial Publishing to Blogs
HackerOne $100 Control Characters Not Stripped From Username on Signup
Yahoo! $1,000 SQL Injection ON HK.Promotion
Slack $500 Reflected Xss
RelateIQ $100 HTML injection in "Invite Collaborators"
Slack $500 Stored XSS in Channel Chat
Slack $100 CSRF vulnerability on https://sehacure.slack.com/account/settings
Slack $500 Stored XSS in username.slack.com
Slack $200 URL redirection flaw
Slack $200 Stored XSS in www.slack-files.com
Yahoo! $100 http://conf.member.yahoo.com configuration file disclosure
HackerOne $500 Weird Bug - Ability to see partial of other user's notification
Slack $100 Slack OAuth2 "redirect_uri" Bypass
Slack $100 Broken Authentication (including Slack OAuth bugs)
Slack $150 Reflective XSS can be triggered in IE
RelateIQ $100 Cross Site Scripting (XSS) - app.relateiq.com
RelateIQ $100 XSRF token problem
RelateIQ $100 Value of JSESSIONID and XSRF token parameter in cookie remains same before and after login
Sandbox Escape $5,000 Win32k Window Handle Vulnerability (EoP) CVE-2014-0262
Phabricator $500 Bypass auth.email-domains (2)
Phabricator $300 Login CSRF using Twitter OAuth
Phabricator $1,000 Bypass auth.email-domains
HackerOne $100 CSS leaks SCSS debug info
Flash $10,000 Flash double free vulnerability leads to code execution CVE-2014-0502
Yahoo! $1,500 XSS on Every sports.yahoo.com page
Flash $2,000 Flash local-with-fileaccess Sandbox Bypass CVE-2014-0508
Yahoo! $1,276 HK.Yahoo.Net Remote Command Execution
Flash $2,000 Handling of jar: URIs bypasses AllowScriptAccess=never CVE-2014-0491
Flash $10,000 Flash type confusion vulnerability leads to code execution CVE-2013-5331
Yahoo! $1,390 Local file inclusion
Yahoo! $3,705 SQLi on http://sports.yahoo.com/nfl/draft
Yahoo! $750 Flickr: Invitations disclosure (resend feature)
HackerOne $100 DNS Misconfiguration
Yahoo! $800 HTML Injection on flickr screename using IOS App
PHP $1,500 PHP Heap Overflow Vulnerability in imagecrop() CVE-2013-7226
Yahoo! $800 XSS in my yahoo
Yahoo! $2,500 Security.allowDomain("*") in SWFs on img.autos.yahoo.com allows data theft from Yahoo Mail (and others)
Sandbox Escape $3,000 Linux 3.4+: arbitrary write with CONFIG_X86_X32 CVE-2014-0038
Yahoo! $1,960 Store XSS Flicker main page
Yahoo! $2,173.75 Cross-site scripting on the main page of flickr by tagging a user.
Yahoo! $677.50 XSS Yahoo Messenger Via Calendar.Yahoo.Com
HackerOne $100 Autocomplete enabled in Paypal preferences
Phabricator $300 Improperly implemented password recovery link functionality
Phabricator $300 Log in a user to another account
HackerOne $100 A password reset page does not properly validate the authenticity token at the server side.
HackerOne $100 Information disclosure (reset password token) and changing the user's password
HackerOne $100 Improper session management
HackerOne $150 Switching the user to the attacker's account
HackerOne $500 Upload profile photo from URL
HackerOne $250 Email spoofing
HackerOne $100 CSRF login
HackerOne $150 Logical issues with account settings
PHP $4,000 PHP openssl_x509_parse() Memory Corruption Vulnerability CVE-2013-6420
The Internet $7,500 TLS Virtual Host Confusion
The Internet $1,500 OpenSSH: Memory corruption in AES-GCM support CVE-2013-4548
Ruby $1,500 Ruby: Heap Overflow in Floating Point Parsing CVE-2013-4164
HackerOne $100 DNS Cache Poisoning
HackerOne $100 Flawed account creation process allows registration of usernames corresponding to existing file names
HackerOne $500 PNG compression DoS
HackerOne $250 GIF flooding
HackerOne $500 Pixel flood attack
HackerOne $100 Session not expired on logout
HackerOne $250 CSP not consistently applied
HackerOne $500 RTL override symbol not stripped from file names
HackerOne $100 Session Management
HackerOne $100 Broken Authentication and session management OWASP A2
HackerOne $100 Real impersonation
HackerOne $500 Missing SPF for hackerone.com