Coordinated and Responsible Vulnerability Disclosure Free Bug Bounty Program 466,516 coordinated disclosures
249,229 fixed vulnerabilities
617 bug bounties with 1239 websites
12,566 researchers, 974 honor badges

Verivox Bug Bounty Program

Verivox runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Verivox

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Verivox and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

verivox.de

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Feel free to report any vulnerability you find on our site.

Testing Requirements:

We're using Cloudflare WAF, so you might get blocked if you send too many automated requests.

Possible Awards:

We're new here, so let's see how we can award you.

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

[email protected]

PGP Key:

Show key

-----BEGIN PGP PUBLIC KEY BLOCK-----

xsBNBFqw22wBCADBTroO2b/qZHAIQBbqy+ov4+jKcX6GKGCS8kaZog6hRlmrJr5C
UiwY47hr/1T5rKfHLO5syqu5rsC8s7+4I3Lz9gtA343EOZEBn8P6rAyNDqwxTrMX
muoXPj6ysY3LrqSUQvwU6CgpCb481k5u47q9/SCvd4tV5jUvLIU4O/9cShZsUIOJ
gHP4nsrjx5/GdqBvme8Sr8ttl9skzK9V79KHAmEHv2krvSwiraaGThya2eHcaK1K
m41liBygfSO3bdj26cs2yzRITBF77ZJ1ZJfWgxOAiRDHO7wgZmtYebleZMak+7tr
af9AeWwyeE9OkaApyOF1q9FImQUU/e25B4i3ABEBAAHNMUFsZXhhbmRlciBCdWNo
bmVyIDxhbGV4YW5kZXIuYnVjaG5lckB2ZXJpdm94LmNvbT7CwI4EEwEIADgWIQRE
+hpOJtMUYkdWBp/V6vUItnaZyAUCWrDbbAIbAwULCQgHAgYVCgkICwIEFgIDAQIe
AQIXgAAKCRDV6vUItnaZyCpYCACNEc8gKM1Yo2JlD1HVsIuOotHDpnK94IjS5dJa
MWUh1lZSbDF07iObN0Mtq2EhGjfqX9oPnNi6J/uh0vM4U9tOPJZx4eaW7omWtBv8
+skTxNgDEbFlFZFdf7tjiHXYu665TYTXhWgfqVRfVf4fM2go+Ds47aj/NGKlyuBJ
1j1JEuz01hFTx3xUKlpNCkMBfrrBf4nVcXZQDASnrkgGbt33YcK1lZJyX2ljYyCC
mH428w30ur5A9w/+fRSRi2Oo8rsRMbDU7UW2kWE2ulVuvFhoPrODYiTg4vrMlzky
3Uiwb7cTFD2YCjB27riO+PANZFD5enssVGzKnnZSo5MlOHiwzsBNBFqw22wBCACp
4k62bTYaT1WEkjNUh+szh9bhYEQEQGkizBrpxSmy0SkBPSVSmXwv+T3r6di06bQ5
SbZpCiLPsvi2OHFmdankwH27d2joNTeK8Z9NFgqUE71Ec3CBWWriD/soq2Mi3itf
l2MNb9WQ7pwbYyYTtLxm3uQr2Qmq+QGDeGiGgN8WIji5JZjLfbLqxVLs2jw/uDH6
2sh5UBKBeQga5NGdjoRzdK5YC2vEEEKLtaMcdMbJPQ41mgU6UQ4tT4aw2DEc498m
ioXcv/E4a/yX+eJqKToG5uasHKRTNfDoGEuvCvDwleB/+IeOPaQWTgT1+r2Ia2wF
WHcy0AJVSvu9OMCEFpj3ABEBAAHCwHYEGAEIACAWIQRE+hpOJtMUYkdWBp/V6vUI
tnaZyAUCWrDbbAIbDAAKCRDV6vUItnaZyKu6B/9aVIYVcs/uxXX/6l48EpRuGk5I
QvoJ4Atu8Jfe1J5EVGXWq4H8PZT9UFJYDdGY49cFuQgINypZAuTuP0AjiKcSP7o8
eSynndDpGBs9sxVJsUHidtPTnBaGPAYISFWz7sp8gt/hBRuL/MEmce1JbNazhxes
lYetRVttCYSXWtrKdqGQxtdO5b2LAA22Vx9eKFRxtbDiwLdQgvrY2reJLNa2uZPC
+ZeCDYCwqj4Jk4f8krr2i6lvxvOcSBQ53Kw6mLQTxypPUQlTykTdvROx24YlMv5H
5A+cdOrUD6S+7ZDRZT4gKc6LQotE2V7hQaGdaEE5p4MESZDeE65/G4phDiHB
=Q49x
-----END PGP PUBLIC KEY BLOCK-----

General Requirements:

Feel free to report any *real* vulnerability you find on our site - except:
* Clickjacking (we know we haven't implemented CSP frame-ancestors yet)
* Missing hardening like
* missing cookie flags
* missing mail protections like SPF, DKIM, DMARC

Testing Requirements:

We're using Cloudflare WAF, so you might get blocked if you send too many automated requests.

Possible Awards:

We're new here, so let's see how we can award you.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 12.11.2019 booklooker.de
 11.11.2019 darty.com
 11.11.2019 rb.ru
 08.11.2019 brickset.com
 08.11.2019 lyricstranslate.com
 08.11.2019 mxplayer.in
 08.11.2019 le.utah.gov
 08.11.2019 upm.es
 08.11.2019 vuze.com
 08.11.2019 k24tv.co.ke

  Latest Blog Posts

30.10.2019 by Nep_1337_1998
Denial of Service vulnerability in script-loader.php (CVE-2018-6389)
17.10.2019 by 0xrocky
Stored XSS
17.10.2019 by geeknik
The "S" in IOT is for Security
16.10.2019 by Fadavvi
Best XSS Vectors
01.10.2019 by Renzi25031469
#Security 100%

  Recent Recommendations

    11 November, 2019
     fislerdata:
Thank you for the assistance. Clearly stated issue, clear report. Thank you for your work
    11 November, 2019
     JosephA44367494:
Special thanks to Nicolas for quickly helping us to patch a vulnerability on our site!
    11 November, 2019
     AmalAyaat:
Thanks for reporting critical vulnerability on one of our sub-domains. We have patched it. Thanks:)
    11 November, 2019
     yikkomolmi:
Thanks for your report. Appreciated your [email protected]:)
    11 November, 2019
     teron60137225:
Thanks for reporting XSS report on our website. Really Appreciated...