ESET bug bounty programs

Out of scope 30

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• Attacks requiring physical Access to user's device

• Clickjacking and issues only exploitable through clickjacking.

• CSRF on forms that are available to anonymous users (e.g. the contact form).

• CSRF on logout

• Denial of Service Attacks

• Descriptive error messages (e.g. Stack Traces, application or server errors)

• Disclosure of known public or non-sensitive files or directories, (e.g. robots.txt,crossdomain.xml or any other policy files, wildcard presence/misconfiguration in these).

• Findings derived primarily from social engineering (e.g. phishing, vishing, smishing) & other non-technical attacks

• Fingerprinting / banner disclosure on common/public services.

• Forgot Password page brute force and account lockout not enforced.

• Host-header injection Attacks

• HTTP 404 codes/pages or other HTTP non-200 codes/pages.

• Hypothetical issues that do not have any practical impact

• Informative severity & low severity issues

• Lack of Secure/HTTP Only/SameSite flags on non-sensitive Cookies.

• Mail configuration issues (SPF, DKIM, DMARC settings)

• Man in the middle attacks

• Management issues with multiple concurrent active sessions

• Missing Security headers (such as Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options)

• Nonstandard HTTP method enabled

• Open redirect that cannot be used to exfiltrate sensitive information (session cookies, OAuth tokens)

• Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality.

• Publicly accessible login panels without proof of exploitation

• Rate-limiting issues

• Reports from automated tools or scans

• Self-XSS and issues exploitable only through Self-XS

• Spamming

• Use of a known-vulnerable library without a description of an exploit specific to our implementation

• Username / email enumeration without any further impact

• Weak Captcha / Captcha Bypass