TOP100PAID.md

Top 100 paid reports from HackerOne:

1. Github access token exposure to Shopify - $50000, 1239 upvotes
2. [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repo to Uber - $39999, 362 upvotes
3. Незащищённый экземпляр Zeppelin to Mail.ru - $35000, 169 upvotes
4. Remote Command Execution via Github import to GitLab - $33510, 314 upvotes
5. RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag) to GitLab - $33510, 310 upvotes
6. RCE via npm misconfig -- installing internal libraries from the public registry to PayPal - $30000, 869 upvotes
7. Arbitrary file read via the bulk imports UploadsPipeline to GitLab - $29000, 303 upvotes
8. Exposed Kubernetes API - RCE/Exposed Creds to Snapchat - $25000, 1144 upvotes
9. Server Side Request Forgery (SSRF) via Analytics Reports to HackerOne - $25000, 461 upvotes
10. SQL Injection in report_xml.php through countryFilter[] parameter to Valve - $25000, 375 upvotes
11. SAML Signature verification bypass allows logging into any user (with specific conditions) to GitHub - $25000, 170 upvotes
12. RepositoryPipeline allows importing of local git repos to GitLab - $22300, 65 upvotes
13. access list owner can escalate his role to the highest roles to Teleport - $21000, 255 upvotes
14. Potential pre-auth RCE on Twitter VPN to X (Formerly Twitter) - $20160, 1202 upvotes
15. Bypass for #488147 enables stored XSS on https://paypal.com/signin again to PayPal - $20000, 2612 upvotes
16. Account takeover via leaked session cookie to HackerOne - $20000, 1565 upvotes
17. Arbitrary file read via the UploadsRewriter when moving and issue to GitLab - $20000, 1461 upvotes
18. Getting all the CD keys of any game to Valve - $20000, 619 upvotes
19. [phpobject in cookie] Remote shell/command execution to Pornhub - $20000, 607 upvotes
20. RCE when removing metadata with ExifTool to GitLab - $20000, 486 upvotes
21. RCE via unsafe inline Kramdown options when rendering certain Wiki pages to GitLab - $20000, 415 upvotes
22. bd-j exploit chain to PlayStation - $20000, 266 upvotes
23. Steal private objects of other projects via project import to GitLab - $20000, 228 upvotes
24. Github Apps can use Scoped-User-To-Server Tokens to Obtain Full Access to User's Projects in Project V2 GraphQL api to GitHub - $20000, 189 upvotes
25. Private objects exposed through project import to GitLab - $20000, 113 upvotes
26. Stored XSS on https://paypal.com/signin via cache poisoning to PayPal - $18900, 665 upvotes
27. Oracle Webcenter Sites administrative and hi-privilege access available directly from the internet (/cs/Satellite) to LocalTapiola - $18000, 264 upvotes
28. Struct type confusion RCE to shopify-scripts - $18000, 9 upvotes
29. Full Response SSRF via Google Drive to Dropbox - $17576, 302 upvotes
30. Stored XSS in markdown via the DesignReferenceFilter to GitLab - $16000, 289 upvotes
31. Arbitrary file read during project import to GitLab - $16000, 183 upvotes
32. Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password to PayPal - $15300, 1366 upvotes
33. Ability to bypass partner email confirmation to take over any store given an employee email to Shopify - $15250, 240 upvotes
34. Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' Application to PlayStation - $15000, 759 upvotes
35. Delete anyone's content spotlight remotely. to Snapchat - $15000, 720 upvotes
36. Time-Based SQL injection at city-mobil.ru to Mail.ru - $15000, 631 upvotes
37. Open prod Jenkins instance to Snapchat - $15000, 428 upvotes
38. file read on MCS servers via supplying a QCOW2 image with external backing file to Mail.ru - $15000, 222 upvotes
39. Incorrect authorization to the intelbot service leading to ticket information to TikTok - $15000, 205 upvotes
40. [mcs.mail.ru] Пользователь с ролью наблюдателя может создавать ключи доступа для очереди сообщений (sqs.mcs.mail.ru) to Mail.ru - $15000, 147 upvotes
41. Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.io to Snapchat - $15000, 126 upvotes
42. Stored XSS via Kroki diagram to GitLab - $13950, 276 upvotes
43. Stored XSS in Notes (with CSP bypass for gitlab.com) to GitLab - $13950, 149 upvotes
44. New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields to GitLab - $13950, 85 upvotes
45. XSS in ZenTao integration affecting self hosted instances without strict CSP to GitLab - $13950, 75 upvotes
46. Mass Accounts Takeover Without any user Interaction at https://app.taxjar.com/ to Stripe - $13000, 180 upvotes
47. IDOR - Delete all Licenses and certifications from users account using CreateOrUpdateHackerCertification GraphQL query to HackerOne - $12500, 313 upvotes
48. An attacker can archive and unarchive any structured scope object on HackerOne to HackerOne - $12500, 312 upvotes
49. Internal attachments can be exported via "Export as .zip" feature to HackerOne - $12500, 258 upvotes
50. View Titles of Private Reports with pending email invitation to HackerOne - $12500, 227 upvotes
51. Spring Actuator endpoints publicly available and broken authentication to LY Corporation - $12500, 226 upvotes
52. Remote vulnerabilities in spp to PlayStation - $12500, 164 upvotes
53. Git flag injection - local file overwrite to remote code execution to GitLab - $12000, 763 upvotes
54. Local files could be overwritten in GitLab, leading to remote command execution to GitLab - $12000, 537 upvotes
55. Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests to GitLab - $12000, 441 upvotes
56. JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions to GitLab - $12000, 354 upvotes
57. Path traversal, to RCE to GitLab - $12000, 136 upvotes
58. Account Takeover via Authentication Bypass in TikTok Account Recovery to TikTok - $12000, 123 upvotes
59. Path traversal in Nuget Package Registry to GitLab - $12000, 84 upvotes
60. WG call injection in /economy/contextcommand to Valve - $12000, 43 upvotes
61. Arbitrary Code Execution via npm misconfiguration – installing internal libraries from the public registry to LY Corporation - $11500, 278 upvotes
62. Shell command injection in https://partner.steamgames.com/apps/communityitems/ via file extension of item_image_small and item_image_large to Valve - $11500, 50 upvotes
63. Exfiltrate and mutate repository and project data through injected templated service to GitLab - $11000, 736 upvotes
64. IDOR to add secondary users in www.paypal.com/businessmanage/users/api/v1/users to PayPal - $10500, 732 upvotes
65. Ability to DOS any organization's SSO and open up the door to account takeovers to Grammarly - $10500, 230 upvotes
66. Use-After-Free In IPV6_2292PKTOPTIONS leading To Arbitrary Kernel R/W Primitives to PlayStation - $10000, 724 upvotes
67. Access to multiple production Grafana dashboards to Snapchat - $10000, 452 upvotes
68. touch.mail.ru / e.mail.ru memory content disclosure to Mail.ru - $10000, 409 upvotes
69. gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in allowed_paths to be read to GitLab - $10000, 402 upvotes
70. SQL injection at fleet.city-mobil.ru to Mail.ru - $10000, 372 upvotes
71. RCE on shared.mail.ru due to "widget" plugin to Mail.ru - $10000, 359 upvotes
72. SSRF on project import via the remote_attachment_url on a Note to GitLab - $10000, 345 upvotes
73. Partial disclosure of report activity through new "Export as .zip" feature to HackerOne - $10000, 342 upvotes
74. Double Payout via PayPal to Coinbase - $10000, 297 upvotes
75. SOCK_RAW sockets reachable from Webkit process allows triggering double free in IP6_EXTHDR_CHECK to PlayStation - $10000, 285 upvotes
76. Deserialization of untrusted data at https://www.redtube.com/media/hls?s=data to Pornhub - $10000, 271 upvotes
77. size_t-to-int vulnerability in exFAT leads to memory corruption via malformed USB flash drives to PlayStation - $10000, 267 upvotes
78. Malformed NAV file leads to buffer overflow and code execution in Left4Dead2.exe to Valve - $10000, 264 upvotes
79. Information Disclosure in /skills call to HackerOne - $10000, 260 upvotes
80. Publicly exposed SVN repository, ht.pornhub.com to Pornhub - $10000, 211 upvotes
81. Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form to HackerOne - $10000, 192 upvotes
82. read new emails from any inbox IOS APP in notification center to Mail.ru - $10000, 186 upvotes
83. Authentication bypass on gist.github.com through SSH Certificates to GitHub - $10000, 167 upvotes
84. CSRF protection bypass in GitHub Enterprise management console to GitHub - $10000, 143 upvotes
85. Use-after-free in setsockopt IPV6_2292PKTOPTIONS (CVE-2020-7457) to PlayStation - $10000, 131 upvotes
86. uber.com may RCE by Flask Jinja2 Template Injection to Uber - $10000, 113 upvotes
87. Using gossip to drain miner wallets to Zilliqa - $10000, 111 upvotes
88. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-check to GitHub - $10000, 77 upvotes
89. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection and audit-forward to GitHub - $10000, 73 upvotes
90. Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise Server to GitHub - $10000, 66 upvotes
91. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via nomad template injection to GitHub - $10000, 56 upvotes
92. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ng to GitHub - $10000, 55 upvotes
93. OneLogin authentication bypass on WordPress sites to Uber - $10000, 53 upvotes
94. Shell command injection in https://partner.steamgames.com/bundles/savestore/ via overwriting asset_path_identifier to Valve - $10000, 43 upvotes
95. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectd to GitHub - $10000, 39 upvotes
96. Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-console to GitHub - $10000, 38 upvotes
97. Invalid handling of zero-length heredoc identifiers leads to infinite loop in the sandbox to shopify-scripts - $10000, 23 upvotes
98. Crash: Overwriting NoMethodError with a builtin class crashes/corrupts memory to shopify-scripts - $10000, 20 upvotes
99. RCE hazard in reporting (via Chromium) to Elastic - $10000, 20 upvotes
100. Segfault and/or potential unwanted (byte)code execution with "break" and "||=" inside a loop to shopify-scripts - $10000, 13 upvotes