Coordinated and Responsible Vulnerability Disclosure Free Bug Bounty Program 456,441 coordinated disclosures
244,448 fixed vulnerabilities
604 bug bounties with 1224 websites
12,323 researchers, 962 honor badges

Avito Bug Bounty Program

Avito runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Avito

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Avito and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:

m.avito.ru
avito.ru

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Out-of-scope vulnerabilities:
- Reports from automated scanners without appropriate analysis or demonstration of security impacts
- Reports about outdated/vulnerable software without exploitation examples
- Self-XSS affecting only current user
- Missing CSRF token in forms, where sensitive information like user data cannot be modified (e.g. logout form)
- Issues related to window.opener
- Session hijacking, session timeout
- Missing security HTTP headers (X-Frame-*, X-Content-*, CSP, HSTS, HPKP)
- Missing SPF, DKIM, DMARC records
- Missing "HttpOnly", "secure", "SameSite" flags for non-sensitive cookies
- Possibilities for exhaustive search by user/item identifiers

Testing Requirements:

Strictly prohibited:
- Searching for vulnerabilities in out-of-scope and 3rd-party services, including payment gateways
- DoS/DDoS/physical access/phishing/social engineering attacks
- Stealing regular users' accounts and performing any other actions affecting their security
- Publishing any sensitive information discovered during security testing

Possible Awards:

Currently only Kudos.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 23.10.2019 bricklink.com
 23.10.2019 gramha.net
 23.10.2019 deskgram.net
 22.10.2019 jpnn.com
 22.10.2019 iphoneitalia.com
 22.10.2019 biggo.com.tw
 22.10.2019 you2repeat.com
 21.10.2019 bfmtv.com
 21.10.2019 carbon38.com
 21.10.2019 register.it

  Latest Blog Posts

17.10.2019 by 0xrocky
Stored XSS
17.10.2019 by geeknik
The "S" in IOT is for Security
16.10.2019 by darknetguy
Best XSS Vectors
01.10.2019 by Renzi25031469
#Security 100%
18.09.2019 by Leon
SSRF | Reading Local Files from DownNotifier server

  Recent Recommendations

    23 October, 2019
     astroseekcom:
Thank you for informing me about xss vulnerability.
    23 October, 2019
     rendkul:
thanks for informing us about xss vulnerability.
    23 October, 2019
     raviakp1004:
Thanks for letting us know about this XSS vulnerability. We appreciate the quick feedback.
    23 October, 2019
     Mrrain_1996:
Thank you a lot for the information and the support on fixing the issue! Very friendly and kind contact.
    23 October, 2019
     faizan_mark:
Thank you a lot for the information and the support on fixing the issue! Very friendly and kind contact.