PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bugcrowd Releases Vulnerability Rating Taxonomy 1.6

bugcrowd.com | vulnerability | #bugcrowd | #ssrf | #dmarc | #vrt | #vulnerability-rating | #email-spoofing | #spf
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd ships VRT 1.6, revising internal SSRF and email spoofing ratings: as major providers rely on DMARC, missing or p=none DMARC now rates P3/P4 thanks to researcher Jacob Wilkin.
Published
Collected

Related coverage

vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.9 with More Classifications for Credential Exposure
Bugcrowd releases VRT 1.9, adding granular Disclosure of Secrets ratings for credential exposure (P5-P1) and new SSTI, Broken Link Hijacking, Password Policy Bypass, and Flash-based CSRF entries.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.8 With New Indicators of Compromise
Bugcrowd releases VRT 1.8, adding race condition and cache poisoning entries, a new Indicators of Compromise category, and downgrading mobile clipboard findings to P5.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.7 With New Automotive Security Misconfiguration
Bugcrowd releases VRT 1.7, adding automotive security misconfiguration ratings after ~10,000 automotive submissions in a year, plus new host header token leakage (P2) and weak 2FA (P4) variants.
vulnerability · bugcrowd.com
First Update to our Vulnerability Rating Taxonomy
Bugcrowd's first Vulnerability Rating Taxonomy update splits XSS by privilege context, rating non-admin-to-anyone stored XSS as P2 and lowering admin-to-anyone and self-XSS ratings.
blog · bishopfox.com
Spoofy: An Email Domain Spoofing Tool
Bishop Fox introduces Spoofy, an open-source tool that checks whether domains can be email-spoofed by analyzing SPF and DMARC records, with authoritative bulk lookups and hand-tested spoof logic.
vulnerability · bugcrowd.com
Announcing Our Latest Vulnerability Rating Taxonomy Update
Bugcrowd announces VRT version 1.11, adding a new Cryptographic Weaknesses top-level category and splitting IDOR into prioritized variants based on identifier type and data impact.
Back