PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

First Update to our Vulnerability Rating Taxonomy

bugcrowd.com | vulnerability | #bug-bounty | #privilege-escalation | #xss | #bugcrowd | #vrt | #vulnerability-rating
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd's first Vulnerability Rating Taxonomy update splits XSS by privilege context, rating non-admin-to-anyone stored XSS as P2 and lowering admin-to-anyone and self-XSS ratings.
Published
Collected

Related coverage

vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.9 with More Classifications for Credential Exposure
Bugcrowd releases VRT 1.9, adding granular Disclosure of Secrets ratings for credential exposure (P5-P1) and new SSTI, Broken Link Hijacking, Password Policy Bypass, and Flash-based CSRF entries.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.8 With New Indicators of Compromise
Bugcrowd releases VRT 1.8, adding race condition and cache poisoning entries, a new Indicators of Compromise category, and downgrading mobile clipboard findings to P5.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.7 With New Automotive Security Misconfiguration
Bugcrowd releases VRT 1.7, adding automotive security misconfiguration ratings after ~10,000 automotive submissions in a year, plus new host header token leakage (P2) and weak 2FA (P4) variants.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.6
Bugcrowd ships VRT 1.6, revising internal SSRF and email spoofing ratings: as major providers rely on DMARC, missing or p=none DMARC now rates P3/P4 thanks to researcher Jacob Wilkin.
vulnerability · bugcrowd.com
Announcing Our Latest Vulnerability Rating Taxonomy Update
Bugcrowd announces VRT version 1.11, adding a new Cryptographic Weaknesses top-level category and splitting IDOR into prioritized variants based on identifier type and data impact.
vulnerability · bugcrowd.com
Bugcrowd Announces the Availability of Self-Service Vulnerability Disclosure Programs
Bugcrowd launches self-service Vulnerability Disclosure Programs: a structured intake and triage pipeline for bug reports, with managed triage for the first 15 or 75 submissions.
Back