Tts


reports in last 90 days

40

disclosed resolved issues

4

disclosed informative issues

1

disclosed N/A issues

Listed on HackerOne — Updated on 2019/10/15

Bug Title Bug Type Found By Report Info Report Status

High Stealing Users OAuth Tokens through redirect_uri parameter

Open Redirect manshum12 Issue was not triaged


Time to close: 47 Days and 19 hours
Resolved

Low Subdomain Takeover due to unclaimed domain pointing to AWS

Off-by-one Error zephrfish Time to triage: 1 Days and 2 hours


Time to close: 100 Days and 14 hours
Resolved

Low SSRF in Search.gov via ?url= parameter

Server-Side Request Forgery (SSRF) niwasaki Time to triage: 10 Days and 11 hours


Time to close: 138 Days and 18 hours
Resolved

Medium xmlrpc.php file enabled - data.gov

Improper Access Control - Generic rooghz Issue was not triaged


Time to close: 0 Days and 21 hours
Duplicate

Medium Blind Stored XSS In "Report a Problem" on www.data.gov/issue/

Cross-site Scripting (XSS) - Stored rioncool22 Time to triage: 1 Days and 14 hours


Time to close: 50 Days and 18 hours
Resolved

Low Unclaimed Github Repository Takeover on https://www.data.gov/labs

Phishing noobzombie Time to triage: 0 Days and 2 hours


Time to close: 9 Days and 5 hours
Resolved

Low Root user disclosure in data.gov domain though x-amz-meta-s3cmd-attrs header

Information Disclosure omnicient Time to triage: 8 Days and 6 hours


Time to close: 233 Days and 5 hours
Resolved

Medium Improper Session management can cause account takeover[https://micropurchase.18f.gov]

Insufficient Session Expiration tikoo_sahil Time to triage: 3 Days and 6 hours


Time to close: 78 Days and 9 hours
Resolved

High Nginx misconfiguration leading to direct PHP source code download

Information Disclosure tolo7010 Time to triage: 0 Days and 0 hours


Time to close: 6 Days and 2 hours
Resolved

Medium The user, who was deleted from Github Organization, still can access all functions of federalist, in case he didn't do logout

Improper Authentication - Generic sp1d3rs Time to triage: 3 Days and 4 hours


Time to close: 45 Days and 9 hours
Resolved

Low Race condition on the Federalist API endpoints can lead to the Denial of Service attack

Violation of Secure Design Principles sp1d3rs Time to triage: 16 Days and 9 hours


Time to close: 23 Days and 2 hours
Resolved

Low The Federalsit session cookie (federalist.sid) is not properly invalidated - backdoor access to the account is possible

Insufficient Session Expiration sp1d3rs Time to triage: 36 Days and 1 hours


Time to close: 13 Days and 18 hours
Resolved

Medium [IDOR] The authenticated user can restart website build or view build logs on any another Federalist account

Insecure Direct Object Reference (IDOR) sp1d3rs Time to triage: 1 Days and 6 hours


Time to close: 1 Days and 21 hours
Resolved

Medium Double Stored Cross-Site scripting in the admin panel

Cross-site Scripting (XSS) - Stored sp1d3rs Time to triage: 0 Days and 15 hours


Time to close: 4 Days and 17 hours
Resolved

Medium SSH server compatible with several vulnerable cryptographic algorithms

Use of a Broken or Risky Cryptographic Algorithm northivanastan Time to triage: 2 Days and 13 hours


Time to close: 2 Days and 1 hours
Resolved

Low Information disclosure (system username) in the x-amz-meta-s3cmd-attrs response header on federation.data.gov

Information Disclosure sp1d3rs Time to triage: 1 Days and 3 hours


Time to close: 5 Days and 18 hours
Resolved

Medium Reflected XSS on the data.gov (WAF bypass+ Chrome XSS Auditor bypass+ works in all browsers)

Cross-site Scripting (XSS) - Reflected sp1d3rs Issue was not triaged


Time to close: 12 Days and 2 hours
Resolved

Medium Cross-Site Request Forgery on the Federalist API (all endpoints), using Flash file on the attacker's host

Cross-Site Request Forgery (CSRF) sp1d3rs Time to triage: 10 Days and 13 hours


Time to close: 9 Days and 8 hours
Resolved

Medium HTML injection (with XSS possible) on the https://www.data.gov/issue/ using media_url attribute

Cross-site Scripting (XSS) - Reflected sp1d3rs Time to triage: 0 Days and 1 hours


Time to close: 3 Days and 5 hours
Resolved

Low Link poisoning on https://secure.login.gov/ login page

Open Redirect albinowax Time to triage: 0 Days and 0 hours


Time to close: 181 Days and 2 hours
Resolved

Critical SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agent

SQL Injection harisec Time to triage: 0 Days and 6 hours


Time to close: 463 Days and 21 hours
Resolved

Medium Multiple Bugs in api.data.gov/signup endpoint leads to send custom messages to Anyone

None supplied nuke11 Time to triage: 54 Days and 8 hours


Time to close: 111 Days and 23 hours
Resolved

Critical Redirect on authorization allows account compromise

Improper Authentication - Generic cablej_dds Time to triage: 3 Days and 13 hours


Time to close: 101 Days and 12 hours
Resolved

Low [idp.fr.cloud.gov] Open Redirect

Open Redirect bobrov Time to triage: 5 Days and 14 hours


Time to close: 72 Days and 4 hours
Resolved

High Defacement of catalog.data.gov via web cache poisoning to stored DOMXSS

Cross-site Scripting (XSS) - Stored albinowax Time to triage: 4 Days and 21 hours


Time to close: 279 Days and 16 hours
Resolved