Phabricator Bug Bounty Program Statistics

Phabricator Program Statistics

60 total issues disclosed

$16,150 total paid publicly

Most disclosed (11 disclosures) — Information Disclosure

Disclosed Reports

Show entries

Search:

Report Title	Vulnerability Type	Disclosed By	Severity	Disclosed on
Abusing daemon logs for Privilege escalation under certain scenarios	Privilege Escalation	tunnelshade	No rating	2014-06-18
Abusing VCS control on phabricator	Privilege Escalation	tunnelshade	No rating	2014-06-13
Administrator can create user without entering high security mode	Improper Authentication - Generic	ivh	Low	2018-05-22
An unsafe design practice in the Passphrase may result in Secret being accidentally changed.	Violation of Secure Design Principles	kevin_c	High	2017-04-04
Autoclose can close any task regardless of policies/spaces	None supplied	almanac	No rating	2017-04-24
Back - Refresh - Attack To Obtain User Credentials	Information Disclosure	xtross1	No rating	2014-07-23
Broken Authentication and Session Management	Improper Authentication - Generic	appsecure_in	No rating	2014-08-05
Bypass auth.email-domains	Improper Authentication - Generic	tomvg	No rating	2014-03-25
Bypass auth.email-domains (2)	Improper Authentication - Generic	tomvg	No rating	2014-03-26
Command injection on Phabricator instance with an evil hg branch name	Command Injection - Generic	pnig0s	Critical	2017-11-11
Content injection	Violation of Secure Design Principles	hackerone_hacker	No rating	2014-12-15
Content spoofing	Cross-site Scripting (XSS) - Generic	djadmin	No rating	2014-09-11
Content Spoofing through URL	Violation of Secure Design Principles	shahmeer-amir	No rating	2014-09-20
Control character allowed in username	None supplied	dawidczagan	No rating	2014-04-12
Credential gets exposed	Information Disclosure	luke081515	Low	2017-08-02
CSRF token valid even after the session logout of a particular user	Cross-Site Request Forgery (CSRF)	appsecure_in	No rating	2014-06-26
Dashboard panel embedded onto itself causes a denial of service	Denial of Service	jbeta	No rating	2015-08-27
Differential "Show Raw File" feature exposes generated files to unauthorised users	Information Disclosure	calvium	Medium	2017-03-16
Enumerating emails through "Forgot Password" form	Violation of Secure Design Principles	denispugachev	No rating	2017-02-06
Error page Text Injection.	Violation of Secure Design Principles	dhanunjaya	No rating	2016-08-25

Showing 1 to 20 of 60 entries

Previous1 2 3Next

BugBountyHunter

Phabricator Program Statistics

Disclosed Reports