GSA Bounty Program Statistics

View program

12 total issues disclosed

$600 total paid publicly

Most disclosed (2 disclosures) — Information Disclosure

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
Denial of service via cache poisoning on https://www.data.gov/ None supplied kq8dq High 2021-06-15
Content injection via URL parameter. Code Injection johnh4x0r No rating 2020-02-08
SSRF in Search.gov via ?url= parameter Server-Side Request Forgery (SSRF) niwasaki Low 2019-08-26
Subdomain Takeover due to unclaimed domain pointing to AWS Off-by-one Error zephrfish Low 2019-08-26
xmlrpc.php file enabled - data.gov Improper Access Control - Generic zddw Medium 2019-08-19
Blind Stored XSS In "Report a Problem" on www.data.gov/issue/ Cross-site Scripting (XSS) - Stored rioncool22 Medium 2019-08-07
Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.gov Information Disclosure ninja_cyber007 Low 2019-08-06
Improper Session management can cause account takeover[https://micropurchase.18f.gov] Insufficient Session Expiration tikoo_sahil Medium 2019-07-30
Unclaimed Github Repository Takeover on https://www.data.gov/labs Phishing noobzombie Low 2019-07-29
Root user disclosure in data.gov domain though x-amz-meta-s3cmd-attrs header Information Disclosure sneakerz Low 2019-07-29
Link poisoning on https://secure.login.gov/ login page Open Redirect albinowax Low 2019-03-25
Email Spoofing - SPF record set to Neutral Violation of Secure Design Principles ramakanthk35 None 2017-09-06