Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
531,152 coordinated disclosures
287,074 fixed vulnerabilities
731 bug bounties with 1,446 websites
14,869 researchers, 1070 honor badges

EMBL-EBI Bug Bounty Program

EMBL-EBI runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of EMBL-EBI

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between EMBL-EBI and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

*.ebi.ac.uk

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Keeping the information we hold secure is of the utmost importance to EMBL-EBI. We value any contribution made by those outside the organisation in improving the security of our services. We are committed to working with the community to verify, reproduce, and respond to legitimate reported vulnerabilities. We encourage the community to participate in our responsible reporting process which applies to services relating to the following domains:

- ebi.ac.uk

Testing Requirements:

We will assess all reports and investigate those reports satisfying the following criteria. We will make every effort to correct any vulnerability within 6 months. To encourage responsible reporting, we commit that we (EMBL) will not take legal action against you or ask law enforcement to investigate you if you comply with the following Responsible Disclosure Guidelines:

- Reporter to provide details of the vulnerability, including information needed to reproduce and validate the vulnerability and a Proof of Concept (POC)
- Reporter to give us up to 6 months to correct the issue before making any information public
- Reporter to make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our services
- Reporter does not modify or access non-public data, or data that is not theirs
- Reporter to refrain from requesting compensation for reporting vulnerabilities. Upon request we will publicly acknowledge reporter’s responsible disclosure after issues are resolved.
- Reporter to refrain from using automated tools to scan for vulnerabilities, as this can have an adverse effect on other users of our services.

Possible Awards:

Reporter to refrain from requesting compensation for reporting vulnerabilities. Upon request we will publicly acknowledge reporter’s responsible disclosure after issues are resolved.

Special Notes:

We will attempt to respond to your report within 5 working days (we are closed over Christmas and New Year).

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

    13 July, 2019
    bugrep0rt:
I found open FTP with details. share mail for send details. Thank you.
    11 July, 2019
    Hide_khan:
please share your mail address for other report

  Latest Patched

 30.03.2020 camaieu.fr
 30.03.2020 anekdotov.net
 29.03.2020 gir.am
 28.03.2020 shorturl.at
 28.03.2020 degruyter.com
 28.03.2020 letmejerk3.com
 28.03.2020 vanityfair.com
 28.03.2020 team1x1.com
 28.03.2020 extrabux.com
 28.03.2020 seguradoralider.com.br

  Latest Blog Posts

12.03.2020 by Rando02355205
(Paypal) www.paypal.com [CSP High Level] - [XSS Reflected] - [Bug Bounty] - [Write Up]
08.03.2020 by CybeReports
JDECO.net XSS Vulnerability| CybeReports
29.02.2020 by Rando02355205
(Google) groups.google.com - [Stored XSS] - [Bug Bounty] - [WriteUp] - [24/02/2020]
10.02.2020 by 0xrocky
Stored XSS on h2biz.net
10.02.2020 by ismailtsdln
SQL Injection Payload List

  Recent Recommendations

    27 March, 2020
     hstead:
Very rapid communication and detailed instructions as to how to fix the issue. Thanks for the assistance.
    27 March, 2020
     PaulMar23292621:
r00tpgp reported a serious issue to us and helped us with reproducing the issue and pushing towards a fix for the problem.
Thank you very much for the great work!
    27 March, 2020
     Michael3277:
Thanks for your report. With your help we could find the bug and make our Website safer!

roker is a friendly Security Resercher who is answering very fast to mails!
    26 March, 2020
     KyleGeorgeArch:
Thank you ElProfesor for responsibly disclosing an XSS issue and providing the reproduction steps. With your help we've identified the issue and are working on a fix. Thank you for your hard work and responsible practices.
    25 March, 2020
     KyleGeorgeArch:
ianf0ns3c identified an XSS issue and provided the reproduction steps in a polite and timely manner, giving us all the information we needed to investigate and take it to our developers. We're grateful for his work on the matter.