PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The State of Vulnerabilities in 2022

bishopfox.com | vulnerability | #bug-bounty | #vulnerability-management | #gitlab | #security-research | #vulnerability-trends | #bounty-payouts
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

An analysis of publicly disclosed bug bounty reports from January–July 2022, surfacing the most frequent vulnerability types, severity trends, and top payouts, including a $29,000 GitLab file read.
Published
Collected

Related coverage

blog · about.gitlab.com
Track organization-wide security risk in one dashboard
For enterprises with many top-level groups, GitLab now aggregates vulnerabilities and a single risk score across your entire organization.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
vulnerability · bugcrowd.com
Inside the Platform: Bugcrowd’s Vulnerability Trends Report
Bugcrowd's annual Inside the Platform report analyzes 2023 vulnerability submissions: higher P1 rewards and open scopes drove 10x more critical findings, while government submissions surged 151%.
vulnerability · hackerone.com
Spotlight on the Server-Side
SSRF ranks among HackerOne's top-paid vulnerabilities, with 196 reports in April alone. The article explains how cloud metadata services amplify impact, citing the Snapchat ad platform token leak.
vulnerability · hackerone.com
This Season, Give the Gift of Data-Driven Insight
HackerOne holiday data shows vulnerability reports rise in the two weeks after Thanksgiving, with XSS surging as online shopping peaks; XSS draws 27.9% of all bounties paid across industries.
vulnerability · bugcrowd.com
Priority One Report: Bug Bounties Paying out for Deep Testing
Bugcrowd's 2019 Priority One Report finds vulnerabilities and payouts nearly doubled year over year, with findings shifting toward systemic bug classes that automated scanners cannot catch.
Back