Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
508,417 coordinated disclosures
277,926 fixed vulnerabilities
702 bug bounties with 1,402 websites
14,402 researchers, 1059 honor badges

Verivox Bug Bounty Program

Verivox runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Verivox

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Verivox and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

verivox.de

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Feel free to report any vulnerability you find on our site.

Testing Requirements:

We're using Cloudflare WAF, so you might get blocked if you send too many automated requests.

Possible Awards:

We're new here, so let's see how we can award you.

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

[email protected]

PGP Key:

Show key

-----BEGIN PGP PUBLIC KEY BLOCK-----

xsBNBFqw22wBCADBTroO2b/qZHAIQBbqy+ov4+jKcX6GKGCS8kaZog6hRlmrJr5C
UiwY47hr/1T5rKfHLO5syqu5rsC8s7+4I3Lz9gtA343EOZEBn8P6rAyNDqwxTrMX
muoXPj6ysY3LrqSUQvwU6CgpCb481k5u47q9/SCvd4tV5jUvLIU4O/9cShZsUIOJ
gHP4nsrjx5/GdqBvme8Sr8ttl9skzK9V79KHAmEHv2krvSwiraaGThya2eHcaK1K
m41liBygfSO3bdj26cs2yzRITBF77ZJ1ZJfWgxOAiRDHO7wgZmtYebleZMak+7tr
af9AeWwyeE9OkaApyOF1q9FImQUU/e25B4i3ABEBAAHNMUFsZXhhbmRlciBCdWNo
bmVyIDxhbGV4YW5kZXIuYnVjaG5lckB2ZXJpdm94LmNvbT7CwI4EEwEIADgWIQRE
+hpOJtMUYkdWBp/V6vUItnaZyAUCWrDbbAIbAwULCQgHAgYVCgkICwIEFgIDAQIe
AQIXgAAKCRDV6vUItnaZyCpYCACNEc8gKM1Yo2JlD1HVsIuOotHDpnK94IjS5dJa
MWUh1lZSbDF07iObN0Mtq2EhGjfqX9oPnNi6J/uh0vM4U9tOPJZx4eaW7omWtBv8
+skTxNgDEbFlFZFdf7tjiHXYu665TYTXhWgfqVRfVf4fM2go+Ds47aj/NGKlyuBJ
1j1JEuz01hFTx3xUKlpNCkMBfrrBf4nVcXZQDASnrkgGbt33YcK1lZJyX2ljYyCC
mH428w30ur5A9w/+fRSRi2Oo8rsRMbDU7UW2kWE2ulVuvFhoPrODYiTg4vrMlzky
3Uiwb7cTFD2YCjB27riO+PANZFD5enssVGzKnnZSo5MlOHiwzsBNBFqw22wBCACp
4k62bTYaT1WEkjNUh+szh9bhYEQEQGkizBrpxSmy0SkBPSVSmXwv+T3r6di06bQ5
SbZpCiLPsvi2OHFmdankwH27d2joNTeK8Z9NFgqUE71Ec3CBWWriD/soq2Mi3itf
l2MNb9WQ7pwbYyYTtLxm3uQr2Qmq+QGDeGiGgN8WIji5JZjLfbLqxVLs2jw/uDH6
2sh5UBKBeQga5NGdjoRzdK5YC2vEEEKLtaMcdMbJPQ41mgU6UQ4tT4aw2DEc498m
ioXcv/E4a/yX+eJqKToG5uasHKRTNfDoGEuvCvDwleB/+IeOPaQWTgT1+r2Ia2wF
WHcy0AJVSvu9OMCEFpj3ABEBAAHCwHYEGAEIACAWIQRE+hpOJtMUYkdWBp/V6vUI
tnaZyAUCWrDbbAIbDAAKCRDV6vUItnaZyKu6B/9aVIYVcs/uxXX/6l48EpRuGk5I
QvoJ4Atu8Jfe1J5EVGXWq4H8PZT9UFJYDdGY49cFuQgINypZAuTuP0AjiKcSP7o8
eSynndDpGBs9sxVJsUHidtPTnBaGPAYISFWz7sp8gt/hBRuL/MEmce1JbNazhxes
lYetRVttCYSXWtrKdqGQxtdO5b2LAA22Vx9eKFRxtbDiwLdQgvrY2reJLNa2uZPC
+ZeCDYCwqj4Jk4f8krr2i6lvxvOcSBQ53Kw6mLQTxypPUQlTykTdvROx24YlMv5H
5A+cdOrUD6S+7ZDRZT4gKc6LQotE2V7hQaGdaEE5p4MESZDeE65/G4phDiHB
=Q49x
-----END PGP PUBLIC KEY BLOCK-----

General Requirements:

Feel free to report any *real* vulnerability you find on our site - except:
* Clickjacking (we know we haven't implemented CSP frame-ancestors yet)
* Missing hardening like
* missing cookie flags
* missing mail protections like SPF, DKIM, DMARC

Testing Requirements:

We're using Cloudflare WAF, so you might get blocked if you send too many automated requests.

Possible Awards:

We're new here, so let's see how we can award you.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 26.02.2020 jobs.ch
 26.02.2020 hardverapro.hu
 26.02.2020 ec.europa.eu
 26.02.2020 arise.com
 26.02.2020 medien-recht.ws
 26.02.2020 nikkei.com
 26.02.2020 e-shop.gr
 26.02.2020 voirfilms.unblock.ws
 26.02.2020 carhartt-wip.com
 25.02.2020 mbworld.org

  Latest Blog Posts

10.02.2020 by 0xrocky
Stored XSS on h2biz.net
10.02.2020 by ismailtsdln
SQL Injection Payload List
20.01.2020 by Rando02355205
XSS on "www.alibaba.com" (Alibaba WAF 405) Bypassed.
16.01.2020 by Open Bug Bounty
Brief Recap of Open Bug Bounty’s Record Growth in 2019
12.01.2020 by JCQ_47
WAF Cloudflare Bypass XSS at Nexusmods.com

  Recent Recommendations

    26 February, 2020
     LarryParker98:
Kunal, thank you for reporting the vulnerability on our web site. We greatly appreciate your help in securing our site.
    25 February, 2020
     ryra16642059:
Thanks AARYAN SAHARAN For informing us about the admin bypass vulner.
Our whole company would like to say thank you to you for helping us! We don't offer any bounty, but as a respect token , A thanks card will be sent to you over mail.
-Cheers!
    25 February, 2020
     CalvinN14532713:
Thank you so much for your hard work with our company! It was a great help and opened us up to perusing a bug bounty in the future!

KhanJanny was very helpful in identifying some vulnerabilities on our site that we were able to resolve!
    25 February, 2020
     CalvinN14532713:
Thank you so much for your hard work with our company! It was a great help and opened us up to perusing a bug bounty in the future!

KhanJanny was very helpful in identifying some vulnerabilities on our site that we were able to resolve!
    25 February, 2020
     markosirec:
Found an xss exploit on our webpage. Thank you!