Bountytalk - Forums Advertising & Bounty Hub
Other Bounties => Bug bounty programs => Topic started by: Angelina on April 19, 2023, 05:30:01 pm
-
Submit bug report: http://www.chinanetcloud.com
@chinanetcloud
ChinaNetCloud
ChinaNetCloud offers server management and cloud computing services for various companies in China, the U.S., Japan, and Singapore.
Policy
Responsible Disclosure Policy
The information on this page is intended for security researchers interested in reporting security vulnerabilities to the ChinaNetCloud security team.
If you believe you've discovered a security vulnerability on a ChinaNetCloud system or application, we strongly encourage you to inform us as quickly as possible and to not disclose the vulnerability publicly until it is fixed. We appreciate your assistance, and we review all reports and will do our best to address the issue in a timely fashion. To encourage responsible disclosure, ChinaNetCloud will not bring a lawsuit against you or ask law enforcement to investigate you if we determine that a disclosure meets the following guidelines.
Responsible Disclosure Guidelines
Notify ChinaNetCloud and provide us details of the vulnerability. Please provide us a reasonable time period to address the issue before public disclosure.
Provide an appropriate level of detail on the vulnerability to allow us to identify and reproduce the issue. Detail should include target URLs, request/response pairs, screenshots, and/or other information. We will confirm your email and evaluate the validity and reproducibility of the issue. For valid issues, we will work to fix the issue and keep you appraised of progress.
Make a reasonable effort to avoid service disruption (e.g. DoS), privacy issues (i.e. accessing a ChinaNetCloud customer’s data, or our customers' users' data), and data destruction when performing vulnerability research.
Do not request compensation for security vulnerability reports either from ChinaNetCloud or external vulnerability marketplaces.
Do not phish or social engineer employees or customers of ChinaNetCloud (this will change later).
Do not run automated scanning tools and send us the output without confirming the issue is present. Security tools often output false positives that should be confirmed by the reporter.
Vulnerability Categories We Encourage
We are primarily interested in hearing about the following vulnerability categories:
Cross Site Scripting (XSS)
Cross Site Request Forgery (CSRF)
SQL Injection (SQLi)
Authentication related issues
Authorization related issues
Data Exposure
Redirection Attacks
Remote Code Execution
Particularly clever vulnerabilities or unique issues that do not fall into explicit categories
If you have any doubt please write us: security@chinanetcloud.com
Vulnerability Categories Ineligible for a bounty, but appreciated
Recently disclosed 0 day vulnerabilities
Use of a known-vulnerable library
XSS attacks via POST or headers
Information disclosure
Software version disclosure
Open redirects
Any low severity issue (not listed on "We Encourage" section)
Out of Scope Vulnerability Categories
The following vulnerability categories are considered out of scope of our responsible disclosure program and will not be eligible for credit on our researcher list.
DNS record related vulnerabilities (SPF, DKIM, DMARC)
Email spoofing, we're aware of this and for now it is "won't fix" issue
SSL vulnerabilities related to configuration or version
Denial of Service (DoS)
User enumeration
Brute forcing
Secure flag not set on non-sensitive cookies
HTTPOnly flag not set on non-sensitive cookies
Logout Cross Site Request Forgery (CSRF)
HTTP TRACE method enabled
Clickjacking on pages without authentication and/or sensitive state changes
Vulnerabilities that require physical access to Victim's computers
Thank you for helping keep ChinaNetCloud and our customers safe.
Domains
www.chinanetcloud.com
opsstack.chinanetcloud.com