Cross-Site Scripting Errors Continue to Be Most Common Web App Flaw

In vulnerability disclosure programs, organizations are paying more in total for XSS issues than any other vulnerability type, HackerOne says.

Cross-site scripting (XSS) errors that allow attackers to inject malicious code into otherwise benign websites continue to be the most common web application vulnerability across organizations.
Bug bounty firm HackerOne recently analyzed data on more than 120,000 security vulnerabilities reported to organizations through the end of 2018 by the hacker community via public and private bug bounty programs. HackerOnes customers classified the vulnerabilities and ranked the top 10 of them by impact, severity, and weakness type.
The analysis showed XSS to be the most common issue for most organizations, even though the threat is often downplayed because it does not always lead to large-scale information breaches, says Miju Han, director of program management at HackerOne.
Our data tells a different story because companies pay out for XSS far more than they do for any other vulnerability class, Han says. In fact, of the $55 million that bug hunters in HackerOnes program have earned so far in total, some $8 million has been from reporting XSS vulnerabilities alone, she says. XSS is important for companies to guard against. XSS is here to stay,
HackerOnes vulnerability analysis revealed other trends as well. The growing adoption of hybrid and multicloud environments, for instance, is putting organizations at increased risk from vulnerabilities such as server-side request forgery (SSRF). These are flaws that allow attackers to read, update, and modify internal resources and connect to services such as HTTP-enabled databases. Much of the exposure is the result of organizations that previously didnt store data online now going all-in on cloud technologies without knowing how to protect their data first.
Information disclosure weaknesses in an application, such as a broken or missing control, are another category of security vulnerabilities that organizations are increasingly becoming exposed to as they adopt cloud environments.
HackerOnes analysis showed that the security vulnerabilities that organizations are willing to pay the most for — on a per vulnerability disclosure basis — include SSRF, privilege escalation flaws, and insecure direct object reference (IDOR) issues that allow attackers to bypass authorization and access control measures.
Such flaws are not as commonly reported as XSS flaws. However, many companies actively give incentives to hackers to search for them because of the risk they pose, according to HackerOnes
report
summarizing its findings. Other low-volume but high-impact web application security flaws for which organizations are willing to pay more include business logic errors and code injection errors.
Interestingly, only four of the vulnerabilities in HackerOnes top 10 list are also on OWASPs top 10 list — a resource that many organizations use to identify top risks. The overlapping flaws including XSS, information disclosure, and code injection errors. But some security vulnerabilities, like XML external entities (XXE) flaws, which ranks fourth in OWASPs Top 10, are nowhere to be found on the HackerOne list.
The reason for the difference is that HackerOnes list represents real-world security risks and not just vulnerabilities ranked by volume, Han says.
Companies are awarding bounties for these vulnerabilities because they could actually have substantial impact on their businesses, she notes. Our data tells the story of which attack vectors hackers are most likely to employ and then which attack vectors are the most valuable to companies.
Related Content:
Bug Hunting Paves Path to Infosec Careers
Bug Bounty Awards Climb as Software Security Improves
Safe Harbor Programs: Ensuring the Bounty Isnt on White Hat Hackers Heads
Effective Pen Tests Follow These 7 Steps

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Cross-Site Scripting Errors Continue to Be Most Common Web App Flaw