Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
491,941 coordinated disclosures
268,403 fixed vulnerabilities
661 bug bounties with 1,339 websites
13,635 researchers, 1032 honor badges

LiveAgent Bug Bounty Program

LiveAgent runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of LiveAgent

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between LiveAgent and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

*.liveagent.com

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Most up to date terms and conditions of our bug bounty program can be found at https://www.liveagent.com/bug-bounty-program/

Share the details of any suspected vulnerabilities with the LiveAgent Development Team at [email protected] Please do not publicly disclose these details outside of this process without explicit permission. If you want to submit multiple reports at once, please submit only one report (the most important if possible) and wait for a response.

You may only test against a LiveAgent hosted application Account for which you are the Account Owner or an Agent authorized by the Account Owner to conduct such testing.
For example:
*yourdomain*.ladesk.com
We will reward you for the following types of vulnerabilities:

Remote Command Execution (RCE)
SQL Injection
Broken Authentication
Broken Session Management
Access Control Bypass
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
Open URL Redirection
Directory Traversal

Reports of when an attacker can only threaten his own account with Admin role only will not be rewarded with a bounty. XSS caused by an Admin will not be rewarded with a bounty.

Testing Requirements:

In reporting any suspected vulnerabilities, please include as much information as possible. Make sure to always include detailed steps to reproduce the found vulnerability in text form, supported by screenshots and/or video.

Possible Awards:

The standard bounty reward is $50 per bounty concerning LiveAgent web application submitted and verified by our development team.
We will only reward the first reporter of a vulnerability. Duplicate reports will not be rewarded.
Vulnerabilites on our webpage www.liveagent.com are not in the scope of our bug bounty program and will NOT be financially rewarded.

Special Notes:

In order to qualify, the vulnerability must exist in the latest public release (including officially released public betas) of the LiveAgent software. Only security vulnerabilities will qualify. We would love it if people reported other bugs via the appropriate channels, but since the purpose of this program is to fix security vulnerabilities, only bugs that lead to security vulnerabilities will be eligible for rewards. Other bugs will be accepted at our discretion.

We prefer communication by email at [email protected]

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

Most up to date terms and conditions of our bug bounty program can be found at https://www.liveagent.com/bug-bounty-program/
Share the details of any suspected vulnerabilities with the LiveAgent Development Team at [email protected]

General Requirements:

You may only test against a LiveAgent Account for which you are the Account Owner or an Agent authorized by the Account Owner to conduct such testing. For example:
*yourdomain*.ladesk.com
We will reward you for the following types of vulnerabilities:

Remote Command Execution (RCE)
SQL Injection
Broken Authentication
Broken Session Management
Access Control Bypass
Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF)
Open URL Redirection
Directory Traversal

Reports of when an attacker can only threaten his own account with Admin role only will not be rewarded with a bounty. XSS caused by an Admin will not be rewarded with a bounty.

Testing Requirements:

In reporting any suspected vulnerabilities, please include as much information as possible. Make sure to always include detailed steps to reproduce the found vulnerability in text form, supported by screenshots and/or video.

Possible Awards:

The standard bounty reward is $50 per bounty concerning LiveAgent web application submitted and verified by our development team.
We will only reward the first reporter of a vulnerability. Duplicate reports will not be rewarded.
Vulnerabilites on our webpage www.liveagent.com are not in the scope of our bug bounty program and will NOT be financially rewarded.

Special Notes:

We prefer communication by email at [email protected]

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 21.01.2020 grandrapidsmi.gov
 20.01.2020 frandroid.com
 20.01.2020 vanityfair.com
 20.01.2020 zapmeta.ng
 20.01.2020 genyt.net
 20.01.2020 baku.ws
 20.01.2020 cqu.edu.au
 20.01.2020 espn.in
 20.01.2020 sahibinden.com
 20.01.2020 singularityhub.com

  Latest Blog Posts

20.01.2020 by Rando02355205
XSS on "www.alibaba.com" (Alibaba WAF 405) Bypassed.
16.01.2020 by Open Bug Bounty
Brief Recap of Open Bug Bounty’s Record Growth in 2019
12.01.2020 by JCQ_47
WAF Cloudflare Bypass XSS at Nexusmods.com
08.01.2020 by devl00p
Top 100 Open Redirect dorks
08.01.2020 by Rando02355205
XSS WAF Bypassed

  Recent Recommendations

    20 January, 2020
     PaulMar23292621:
Miguel showed us several information disclosure issues with our site. Thank you very much Miguel!
    18 January, 2020
     damnitjim:
Thanks for taking the time to report the weaknesses and really appreciate the wapiti tool that you've developed.
    17 January, 2020
     gexsi_search:
Many thanks for your support!
    17 January, 2020
     smay84:
Thank you for your quick response and helpful information.
    17 January, 2020
     RohitIn20189381:
Great job on finding that XSS.