Appliances - Barracuda Networks, Inc.

Description

Barracuda Networks launched our bug bounty program on November 9, 2010. The response from the research community has been tremendous. Numerous researchers like yourself have contacted us over the years and have made a substantial contribution to our efforts to deliver high-quality security products to our customers. This program focuses on our appliance-based products. Please refer to the "In Scope Targets" list below for the current products included in this bounty program. Documentation Documentation and User's Guides can be found at: https://campus.barracuda.com/

Targets

Credentials and Access Barracuda does not host any appliances for researchers to test against. As such, we encourage researchers to perform testing using their own appliances. Our appliances are available as virtual machine images, and evaluation licensing is available upon request though our website. Out of Scope All Barracuda Networks, Inc. systems and services not listed above are explicitly excluded from the bounty program. This includes, but is not limited to, products hosted for sales demonstration purposes. Any researcher seeking to perform vulnerability testing upon excluded systems must have prior written consent from the Security team at Barracuda Networks, Inc. and should be requested through established Bugcrowd communication channels. Denial of Service testing is strictly prohibited on any Barracuda Asset. If you identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Barracuda, it may be reported to this program. Note that this is in the spirit of "If you see something, say something" only. Reports of this type are appreciated - but may be marked as 'Not Applicable' and will not be eligible for monetary compensation. Active testing on all out-of-scope targets is expressly prohibited. The following bug classes will be considered for monetary rewards Unauthenticated bugs that lead to code execution or authentication bypass. Datapath bugs that lead to code execution. Unauthenticated disclosure of highly sensitive information. Note regarding product deficiencies The program relates to security vulnerabilities in the products. Deficiencies in product functionality are excluded and will be marked as Not Applicable. This includes but is not limited to: Bypasses for the default set of signatures in the Barracuda Web Application Firewall - for example, bypasses for XSS or SQL Injection protection Bypasses for content filtering as applied to email or web filtering Inaccuracies in content categorization for web filtering Bypasses for anti-virus in email or web filtering Note from our legal team This program is not open to minors, individuals on sanctions lists or individuals in countries on sanctions lists. You are responsible for any tax implications or additional restrictions depending on your country and local law. Barracuda Networks strictly complies with US export laws and regulations. Persons and entities in countries embargoed by the US government or denied from accessing US technology are prohibited from accessing Barracuda Networks systems and participating in this program. We reserve the right to cancel this program at any time and the decision to pay a reward is entirely at our discretion. The decision of Barracuda Networks is final and non-appealable. This offer is void where prohibited by law and in participating, you must not violate any law. You also must not disrupt any service or compromise anyone's data. Thank you for your interest in the Barracuda Security Bug Bounty Program and for helping Barracuda Networks make our products more secure.

In scope targets (in scope)

Any domain/property of Barracuda not listed here in the targets section is out of scope. This includes any/all products not listed here.