Rambler&Co. LiveJournal blogging platform
Bug bounty on Standoff 365 livejournal.com
Accepting reports
domain
- Top reward
- $6,049
- Top severity paid
- Critical
- Assets in scope
- 1
- Public CVEs
- 3
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $6,049
- for critical bugs.
- Report on Standoff 365
- Submit through the program page.
Rewards
What Standoff 365 lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$6,049 |
Reward range in US dollars. Standoff 365's own page has the details.
Scope
1 asset you may test.
Domains 1
- www.livejournal.com
Changes
Tracked since 12 Nov 2026. Last checked 17 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2005-4454 | Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks via a "\" (backslash) within a "javascript" scheme in a style property (such as "javas\cript"), which bypasses the "javascript" check before the "\" is stripped and then rendered in web browsers t | Medium 4.3 | 21 Dec 2005 |
| CVE-2005-4455 | cleanhtml.pl 1.129 in LiveJournal CVS before Dec 13 2005 allows remote attackers to inject scripting languages via the XSL namespace in XML, via vectors such as customview.cgi. | Medium 5.0 | 21 Dec 2005 |
| CVE-2004-0310 | Cross-site scripting (XSS) vulnerability in LiveJournal 1.0 and 1.1 allows remote attackers to execute Javascript as other users via the stylesheet, which does not strip the semicolon or parentheses, as demonstrated using a background:url. | Medium 6.8 | 23 Nov 2004 |