PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Open-Xchange Approaches 3 Years of Bug Bounties & 250 Valid Vulnerabilities

hackerone.com | research | #bug-bounty | #dovecot | #cvss | #open-xchange | #ox-app-suite | #powerdns
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Open-Xchange marks three years of bug bounties for OX App Suite, PowerDNS, and Dovecot with 250 valid vulnerabilities. Rewards follow a CVSS-based rating, with critical bugs earning up to $5,000.
Published
Collected

Related coverage

research · hackerone.com
PayPal on Creating Strong Relationships with Security Researchers
PayPal's bug bounty team has awarded over $6 million to some 3,000 hackers since 2012, and shares lessons on researcher relationships: open feedback, transparency, and objective CVSS-based rewards.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
blog · hackerone.com
Vulnerability Prioritization Is Broken: Your Mediums Are Chaining Into Criticals
HackerOne argues severity-sorted queues fail against AI-driven chaining: medium and low findings combine into cloud credential compromise, so prioritization must be chain-aware.
blog · hackerone.com
Internal vs. Expert Triage: Why the Vulnerability Management Method You Pick Matters
HackerOne sees 60-80% of submissions invalid and SANS reports 73% cite false positives. The article frames triage as a production process and weighs in-house vs expert triage tradeoffs.
blog · hackerone.com
When Every Minute Counts: How Agentic AI Accelerates Exposure Prioritization
HackerOne's Hai Priority Escalation Agent fuses technical severity with business context such as asset priority, sensitive data, and exploitability to surface critical exposures at submission.
Back