PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Announcing Our Latest Vulnerability Rating Taxonomy Update

bugcrowd.com | vulnerability | #bug-bounty | #cryptography | #idor | #bugcrowd | #triage | #vrt | #vulnerability-rating
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd announces VRT version 1.11, adding a new Cryptographic Weaknesses top-level category and splitting IDOR into prioritized variants based on identifier type and data impact.
Published
Collected

Related coverage

vulnerability · bugcrowd.com
Bugcrowd Announces the Availability of Self-Service Vulnerability Disclosure Programs
Bugcrowd launches self-service Vulnerability Disclosure Programs: a structured intake and triage pipeline for bug reports, with managed triage for the first 15 or 75 submissions.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.8 With New Indicators of Compromise
Bugcrowd releases VRT 1.8, adding race condition and cache poisoning entries, a new Indicators of Compromise category, and downgrading mobile clipboard findings to P5.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.7 With New Automotive Security Misconfiguration
Bugcrowd releases VRT 1.7, adding automotive security misconfiguration ratings after ~10,000 automotive submissions in a year, plus new host header token leakage (P2) and weak 2FA (P4) variants.
vulnerability · bugcrowd.com
Bugcrowd Releases Vulnerability Rating Taxonomy 1.6
Bugcrowd ships VRT 1.6, revising internal SSRF and email spoofing ratings: as major providers rely on DMARC, missing or p=none DMARC now rates P3/P4 thanks to researcher Jacob Wilkin.
vulnerability · bugcrowd.com
First Update to our Vulnerability Rating Taxonomy
Bugcrowd's first Vulnerability Rating Taxonomy update splits XSS by privilege context, rating non-admin-to-anyone stored XSS as P2 and lowering admin-to-anyone and self-XSS ratings.
vulnerability · bugcrowd.com
VRT v1.10 Released: Flash downgrades and extended automotive categorization
Bugcrowd released VRT v1.10: new automotive categories from its Stellantis partnership, Flash entries downgraded to P5 after end of life, and Secure Code Warrior training mappings for remediation.
Back