PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[Guest Post] SoundCloud Takes its Bug Bounty Program Public

bugcrowd.com | vulnerability | #bug-bounty | #xss | #bugcrowd | #crowdsourced-security | #csrf | #program-launch | #soundcloud
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

SoundCloud security engineer Tobias Schmidt announces a public bug bounty on Bugcrowd, paying up to $1,500 per valid vulnerability across its website, APIs and mobile apps.
Published
Collected

Related coverage

vulnerability · bugcrowd.com
Bugcrowd Announces the Availability of Self-Service Vulnerability Disclosure Programs
Bugcrowd launches self-service Vulnerability Disclosure Programs: a structured intake and triage pipeline for bug reports, with managed triage for the first 15 or 75 submissions.
vulnerability · bugcrowd.com
Bigbank Launches Vulnerability Disclosure Program
Estonian bank Bigbank moves to a managed Bugcrowd VDP after its self-run program was flooded by inconsistent reports; managed triage filters noise and helps surface systemic issues faster.
vulnerability · bugcrowd.com
Introducing the Overstock.com Vulnerability Disclosure Program
Overstock.com publicly launches a vulnerability disclosure program on Bugcrowd, letting its global research community report security issues directly to the retailer's IT security team.
vulnerability · bugcrowd.com
Intercom launches public bug bounty; offers up to $1,500 per vulnerability
Intercom moved its Bugcrowd bounty to public, paying up to $1,500 per vulnerability. Scope covers the main application and iOS and Android SDKs, part of its secure development lifecycle.
vulnerability · bugcrowd.com
XSS Bugs that Prove the Danger in ‘XSS-Fatigue’
Bugcrowd pushes back on XSS-fatigue: over 25% of its submissions are XSS, and chained XSS plus CSRF attacks have enabled account takeover. Real cases and the updated VRT show XSS is still high impact.
vulnerability · portswigger.net
On-site request forgery
Stored on-site request forgery works even where XSS is blocked: controlling part of an image URL forces arbitrary on-site GET requests, e.g. creating a backdoor when an admin views the page.
Back