For the next two months, developers who report vulnerabilities as part of Microsoft’s Online Services bounty program will receive doubled rewards for their work, the company announced.
Starting on March 1, 2017 until May 1, 2017, eligible vulnerability discoveries submitted for Microsoft Office 365 Portal and Microsoft Exchange Online will be rewarded twice as much as before.
Developers interested in getting the double rewards should be looking for vulnerabilities in six of the company’s domains: portal.office.com, outlook.office365.com, outlook.office.com, *.outlook.com, and outlook.com.
Microsoft launched the Online Services Bug Bounty program in September 2014 , and expanded it in April 2015 and August 2015 to add various Azure and Office 365 properties. Last year, the company added OneDrive to the program.
The company would normally pay between $500 and $15,000 for vulnerabilities in the online services, but bugs submitted during March and April can bring payments between $1,000 and $30,000. All of the vulnerabilities listed in the Online Services Bug Bounty Terms are eligible for the increased bounties.
On its Online Services Bug Bounty portal, Microsoft lists as eligible submissions the following types of vulnerabilities: Cross Site Scripting (XSS), Cross Site Request Forgery (CSRF), Unauthorized cross-tenant data tampering or access (for multi-tenant services), Insecure direct object references, Injection Vulnerabilities, Authentication Vulnerabilities, Server-side Code Execution, Privilege Escalation, Significant Security Misconfiguration (when not caused by user).
“We realize the desire of researchers and customers to security test our services to ensure they can trust us and our solutions. We also believe that if a researcher informs us of a security flaw in our Office 365 services, they should be awarded for protecting us. These discoveries along with our internal security testing efforts contribute to keeping our users safe,” Akila Srinivasan and Travis Rhodes, Microsoft Security Response Center, note in a blog post.
Related: Darknet Marketplace Hansa Launches Bug Bounty Program
Related: Netgear Launches Bug Bounty Program
More from Ionut Arghire
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- CISA, NSA Issue Guidance for IAM Administrators
- Cisco Patches High-Severity Vulnerabilities in IOS Software
- ‘Nexus’ Android Trojan Targets 450 Financial Applications
- ‘Badsecrets’ Open Source Tool Detects Secrets in Many Web Frameworks
- Chrome 111 Update Patches High-Severity Vulnerabilities
Latest News
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- Watch on Demand: Supply Chain & Third-Party Risk Summit Sessions
- TikTok CEO Grilled by Skeptical Lawmakers on Safety, Content
- CISA, NSA Issue Guidance for IAM Administrators
