Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
555,864 coordinated disclosures
356,678 fixed vulnerabilities
845 bug bounties with 1,632 websites
17,373 researchers, 1153 honor badges

united-domains AG Bug Bounty Program

united-domains AG runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of united-domains AG

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between united-domains AG and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:

help.united-domains.de
blog.united-domains.de
united-domains.de
ud-reselling.com
domain-recht.de

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Data protection and security have always had a special meaning and, therefore, a particular concern for united-domains. We have a deep desire to see the Internet remain as safe as possible for us all. That is why we take security issues very seriously.

We are interested in hearing about any potential security issues on united-domains websites, web services, and products. To be eligible for a reward, note that we typically require the issue report to have some actual security impact in a realistic scenario. That does not mean you need to exploit issues fully. Just provide the information you have, and we will analyze your report and draw conclusions on the impact.

In our opinion, the practice of responsible disclosure is the best way to safeguard the Internet. It allows individuals to notify companies like united-domains of any security threats before going public with the information. That gives us a fighting chance to resolve the problem before the criminally-minded become aware of it.

Responsible disclosure is the industry's best practice, and we recommend it as a procedure for anyone researching security vulnerabilities.

We are happy to thank everyone who submits accurate reports which help us improve the security of united-domains. However, only those that meet the following eligibility requirements may receive a monetary reward:
* You must be the first reporter of a vulnerability.
* The vulnerability must be a qualifying vulnerability
* Any weakness found must be reported no later than 24 hours after discovery and exclusively through openbugbounty.org
* You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.
* You must avoid tests that could cause degradation or interruption of our service (refrain from using automated tools, and limit yourself about requests per second).
* You must not leak, manipulate, or destroy any user data.
* You must not be a former or current employee of united-domains or one of its contractors.
* Reports about vulnerabilities are examined by our security analysts. Our analysis is always based on the worst-case exploitation of the vulnerability, as is the reward we pay.
* No vulnerability disclosure, including partial, is allowed for the moment.

Qualifying Vulnerabilities:
* Cross-Site Scripting (XSS)
* Local files access and manipulation (LFI, RFI, XXE, SSRF, XSPA)
* Authentication and Authorization Flaws
* Cross-Site Request Forgery (CSRF)
* Remote Code Execution (RCE)
* Code injections (HTML, JS, SQL, PHP, etc.)
* Insecure direct object references
* CORS
* Directory Traversal
* Privilege Escalation

Non-Qualifying Vulnerabilities:
* Self XSS
* Missing cookie flags
* SSL/TLS best practices
* Mixed content warnings
* DoS or DDoS attacks
* HTTP Host Header XSS
* Clickjacking/UI redressing
* Software version disclosure
* Stack traces or path disclosure
* Physical or social engineering attempts
* Recently disclosed 0-day vulnerabilities
* Presence of autocomplete attribute on web forms
* Vulnerabilities affecting outdated browsers or platforms
* Issues that require physical access to a victim's computer/device
* Logout and other instances of low-severity Cross-Site Request Forgery
* Missing security-related HTTP headers which do not lead directly to a vulnerability
* Reports from automated web vulnerability scanners (Acunetix, Vega, etc.) that have not been validated
* Invalid or missing SPF (Sender Policy Framework) records (Incomplete or missing SPF/DKIM/DMARC)

We ask you to abide by the following guidelines:
* Unless united-domains permits you, do not disclose any issues to the public, or any third party.
* Unless united-domains permits you, do not publish any report submitted concerning this program.
* If you have questions on timelines (to remediation, bounty, etc.), please ask directly in the relevant report.

Testing Requirements:

There are some things we explicitly ask you not to do:
* When experimenting, please only attack test accounts you control. A Proof of Concept unnecessarily involving accounts of other end users or united-domains employee may be disqualified.
* Do not run automated scans without checking with us first.
* Do not test the physical security of united-domains offices, employees, equipment, etc.
* Do not test using social engineering techniques (phishing, vishing, et.c.)
* Do not perform DoS or DDoS attacks.
* In any way, attack our end users, or engage in trade of stolen user credentials.

In scope:
www.united-domains.de
blog.united-domains.de
help.united-domains.de
domain-recht.de
ud-reselling.com

Out of scope:
All other companies and services acquired by united-domains are not in scope. That includes other hostnames or other subdomains not listed as in scope.

Possible Awards:

We reserve the right to adjust the bounty amount and change the report's vulnerability level accordingly, as well as not make a payout if, in our opinion, the above criteria have not been met. These bounties are only a guideline.

* Low 50 €
* Medium 125 €
* High 250 €
* Critical 500 €

Special Notes:

If you have any further questions, please do not hesitate to contact us.

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

Please send us an email to bug [at] united-domains [dot] de

General Requirements:

Please see above

Testing Requirements:

Please see above

Possible Awards:

Please see above

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 12.08.2020 prisguiden.no
 12.08.2020 daveramsey.com
 12.08.2020 2gis.kz
 12.08.2020 themoviedb.org
 12.08.2020 arb.ca.gov
 12.08.2020 lightningmaps.org
 12.08.2020 univ-poitiers.fr
 12.08.2020 wirtualnemedia.pl
 11.08.2020 wuzzuf.net
 11.08.2020 inmotionhosting.com

  Latest Blog Posts

24.06.2020 by Gkexamquiz
How to Find Contacts To Report Bugs & Security Vulnerabilities | Bug Bounty Tutorials 2020
24.06.2020 by 0xcrypto
Improper Access Control - Generic: Unrestricted access to any "connected pack" on docs in coda.io
04.04.2020 by Rando02355205
(Alibaba) message.alibaba.com [IDOR] - [Bug Bounty]
12.03.2020 by Rando02355205
(Paypal) www.paypal.com [CSP High Level] - [XSS Reflected] - [Bug Bounty] - [Write Up]
08.03.2020 by CybeReports
JDECO.net XSS Vulnerability| CybeReports

  Recent Recommendations

    12 August, 2020
     www_aasv_org:
Caught me having forgotten to entity-encode values when re-displaying an incomplete form submission. While the initial report was all I needed to patch, Rajash considerately provided additional detail without being asked through the openbugbounty comments.
    10 August, 2020
     msawired:
Thank you for reporting the XSS vulnerability. Your explanations were very helpful, and we were able to resolve the issue in no time.
    6 August, 2020
     Robert_CMI:
Thank you Rajesh for reporting vulnerabilities on our website, your quick and detailed response was very valuable to us!
    6 August, 2020
     StefanCink:
Thanks to @singhnitesh21 we were able to close a vulnerability on our website asap. Thank you!
    5 August, 2020
     kkb5mobile:
Thank you for pointing out the vulnerability.
Thanks to you, I was able to respond safely.