Organisations Paid Hackers US$23.5 Million for These 10 Vulnerabilities in One Year

By : Krishna Anindyo | Friday, October 30 2020 - 11:20 IWST

Ilustration Hackers (Photo by
Ilustration Hackers (Photo by - Singapore - In times of uncertainty, security becomes an ever more pressing priority. The stakes are high: organisations are more reliant on technology than ever and anyone relying on technology can lose everything in a data breach. But some of the most recent vulnerabilities have one thing in common: they were detected, discovered and reported by friendly hackers who can think like attackers.

“This year, organisations worldwide were forced to go digital with their product offerings and services,” said HackerOne Senior Director of Product Management Miju Han.

“Businesses scrambled to find new revenue streams, creating digital offerings for customers whose lifestyles had dramatically changed. Tens of millions of workers started working remotely whether or not they were ready. With this accelerated pace of digital transformation, CISOs had to quickly facilitate new needs while ensuring the security of existing systems. Faced with these obstacles, security leaders have gained newfound appreciation for hacker-powered security as a nimble, scalable, and cost-effective solution to augment their own resources and offer a pay-for-results approach that’s more justifiable under tightened budgets,” added Miju Han.

HackerOne maintains the most authoritative database of vulnerabilities in the industry. With over 200,000 valid vulnerabilities found by hackers, HackerOne took a look into this data to glean insights from the top 10 most impactful and rewarded vulnerability types.

HackerOne’s Top 10 Most Impactful and Rewarded Vulnerability Types of 2020, in descending order, are:

Cross-site Scripting (XSS), Improper Access Control , Information Disclosure, Server-Side Request Forgery (SSRF)

Insecure Direct Object Reference (IDOR)

Privilege Escalation

SQL Injection

Improper Authentication 

Code Injection

Cross-Site Request Forgery (CSRF)

Taking a closer look at this year’s top ten in comparison to the 2019 top ten vulnerabilities, key findings include:

Cross-site Scripting vulnerabilities continue to be a major threat to web applications as attackers exploiting XSS attacks can gain control of the user’s account and steal personal information such as passwords, bank account numbers, credit card information, personally identifiable information (PII), social security numbers, and more.

The most awarded vulnerability two-years running, XSS vulnerabilities cost organisations US$4.2 million in total bounty awards, up 26% from the previous year. These bugs account for 18% of all reported vulnerabilities, but the average bounty award is just US$501.

With the average bounty for a critical vulnerability being US$3,650, this means organisations are mitigating this common, potentially painful bug on the cheap.

Improper Access Control (up from ninth place in 2019) and Information Disclosure (still holding the third spot) remain common. Awards for Improper Access Control increased 134% year over year to just over US$4 million.

Information Disclosure was not far behind, increasing 63% year over year. Access control design decisions have to be made by humans, not technology, and the potential for errors is high, and both errors are nearly impossible to detect using automated tools.

SSRF vulnerabilities, which can be exploited to target internal systems behind firewalls, show the risk of cloud migrations. Previously, SSRF bugs were fairly benign and held our seventh place spot, as they only allowed internal network scanning and sometimes access to internal admin panels.

But in this era of rapid digital transformation, the advent of cloud architecture and unprotected metadata endpoints has rendered these vulnerabilities increasingly critical.

SQL Injection is dropping year-over-year. Considered one of the worst threats to web application security by OWASP and others, the scale of SQL injection attacks can be devastating, as sensitive data, including business information, intellectual property, and critical customer data, is stored on database servers susceptible to these attacks.

In years past, SQL injection was one of the most common vulnerability types. However, our data indicate that it’s been dropping year-over-year from fifth in 2019 to seventh in 2020. By shifting security left, organisations are leveraging hackers and other methods to proactively monitor attack surfaces and prevent bugs from entering code.

“Finding the most common vulnerability types is inexpensive,” Han continued.

“Of the top 10 most awarded weakness types, only Improper Access Control, Server-Side Request Forgery (SSRF), and Information Disclosure saw their average bounty awards rise more than 10%. The others fell in average value or were nearly flat. Unlike traditional security tools and methods, which become more expensive and cumbersome as goals change and attack surface expands, hacker-powered security is actually more cost-effective as time goes on. With hackers, it’s becoming less expensive to prevent bad actors from exploiting the most common bugs.” concluded Han.

News Comment

Today's Industry

Alternative tobacco products. (Photo:

Rabu, 21 September 2022 - 11:20 WIB

Indonesia Needs to Encourage Alternative Tobacco Products Research Collaboration

The scientific studies development on alternative tobacco products in Indonesia is still too minimal. The Indonesian government is suggested to encourage research collaboration on alternative…

Alternative tobacco products. (Photo:

Rabu, 14 September 2022 - 12:30 WIB

Adult Smokers Entitled to Valid and Reliable Information of Alternative Tobacco Products

Public owns the rights to obtain valid and reliable information to improve their health quality. The same rights is also owned by adult smokers, particularly to pertinent information about the…

Tikki Pangestu, the former Director of Policy Research and Cooperation of World Health Organization (WHO). (Photo:

Selasa, 06 September 2022 - 19:10 WIB

Alternative Tobacco Products, Strategy to Reduce Smoking Prevalence

The high smoking prevalence has been closely associated with increased smoking-related diseases. Alternative tobacco products are predicted to be one of the solutions that can help reduce smoking…

(Photo: © 2022 KRAIBURG TPE)

Selasa, 30 Agustus 2022 - 21:54 WIB

TPE: The Trusted Material For Medical Diagnostic Equipment

KRAIBURG TPE’s THERMOLAST® H TPE HC/AP series enhances design and functionality of medical diagnostic equipment.

Qatar Airways became an Official Jersey Partner in June 2022, with the World's Best Airline logo now featured on the front of the iconic Rouge & Blue shirt.

Selasa, 30 Agustus 2022 - 20:34 WIB

Take-Off for Kick-Off: Qatar Airways Holidays Launches Paris Saint-Germain Fan Travel Packages for an Unforgettable Parisian Sport Vacation

Qatar Airways Holidays is celebrating its role as Official Fan Travel Packages Partner of Paris Saint-Germain by launching all-inclusive travel packages for fans to attend any 2022-23 season…