{"id":"05bf79c8-a745-4071-8685-9425834d9ad2","engagementId":"aac74a54-b65c-429e-8726-9ec4042ae600","data":{"brief":{"id":"b7f42707-9c20-4765-904b-d7b088712b96","name":"Absolute Software Vulnerability Disclosure Pro Engagement","tagline":"Computer and Network Security","description":"\u003cp\u003eAbsolute Software empowers enterprises, governments, educational institutions, and other organizations to remain resilient amid evolving cyber threats. Founded in 1993 as a platform to track, manage, and trace computers in the education sector, Absolute has grown into the only provider of truly intelligent, self-healing security solutions.\u003c/p\u003e\n\n\u003cp\u003eEmbedded in over 600 million endpoints at the factory level, Absolute uniquely enables a permanent digital connection that delivers dynamic visibility, control, and self-healing capabilities across endpoints, applications, and network connections. We are the first and only company to provide uncompromised visibility and near real-time remediation of security breaches at the source.\u003c/p\u003e\n\n\u003cp\u003eWe recognize that no technology is perfect. Absolute believes that collaboration with skilled security researchers worldwide is essential to identifying and addressing potential weaknesses. We invite you to participate in our Vulnerability Disclosure Program to help us strengthen the security of our products and services.\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards\u003c/h2\u003e\n\n\u003cp\u003eNo monetary rewards or bounties are offered for this program.\u003c/p\u003e\n\n\u003cp\u003eFor the initial assessment of reported findings, Absolute follows the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e to determine severity and prioritization. However, in certain cases, the assigned priority may be adjusted based on the specific likelihood or impact within our environment.\u003c/p\u003e\n\n\u003cp\u003eIf a finding’s severity is downgraded, the researcher will receive a detailed explanation outlining the rationale for the adjustment, along with an opportunity to appeal and provide additional context or evidence to support a higher rating.\u003c/p\u003e","industryTagId":null,"targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Absolute Software not listed in the targets section is out of scope. This includes any/all subdomains not listed above. \u003c/p\u003e\n\n\u003ch2\u003eEngagement Guidelines\u003c/h2\u003e\n\n\u003cp\u003eTo ensure a safe and constructive engagement:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eUse non-destructive proof-of-concepts. Demonstrate impact without altering data or configurations.\u003c/li\u003e\n\u003cli\u003eDo not attempt to escalate privileges, pivot, or persist access within Absolute systems.\u003c/li\u003e\n\u003cli\u003eAvoid any test that could affect service availability or customer experience.\u003c/li\u003e\n\u003cli\u003eKeep all testing focused on verifying vulnerabilities — not exploiting them.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess\u003c/h2\u003e\n\n\u003cp\u003eAll targets within the scope are publicly accessible from the internet.\u003c/p\u003e\n\n\u003ch3\u003eCredentials\u003c/h3\u003e\n\n\u003cp\u003eCredentials will not be provided for testing. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eThe following activities are strictly prohibited to ensure the safety of customers, operations, and third parties:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny testing involving systems, environments, or data belonging to Absolute customers.\u003c/li\u003e\n\u003cli\u003eAttempts to access, exfiltrate, or modify production data or customer information.\u003c/li\u003e\n\u003cli\u003eDenial-of-Service (DoS) testing or any activity that could degrade, interrupt, or overload production systems.\u003c/li\u003e\n\u003cli\u003eAutomated, high-volume scanning, brute-force attacks, or fuzzing.\u003c/li\u003e\n\u003cli\u003eSocial engineering or phishing of Absolute employees, contractors, customers, or partners.\u003c/li\u003e\n\u003cli\u003eTesting of third-party vendors, partners, or integrations not explicitly listed as in scope.\u003c/li\u003e\n\u003cli\u003eExploiting publicly known, unpatched vulnerabilities or misconfigurations.\u003c/li\u003e\n\u003cli\u003eUse of compromised credentials, tokens, or accounts obtained outside your authorized testing.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eAny testing that causes service disruption, data exposure, or unauthorized access to customer systems will be considered non-compliant with this policy and may result in removal from the program.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e for clarification before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"dffea584-2615-4e0b-b724-6b6acd632440","name":"In Scope ","targets":[{"id":"c5fb6c46-448f-4105-b28f-378018375ce5","uri":"","name":"*.fr1.absolutegov.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"7efebbfe-f8d6-4839-8c52-7f1a2efeed8e","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c5fb6c46-448f-4105-b28f-378018375ce5"}],"recentChangeFlags":null},{"id":"cba8d62d-9d0c-406b-ad77-b5ff29155f2b","uri":"","name":"*.absolute.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b92f9995-e1f1-490a-994a-0d3e8eec77e4","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"cba8d62d-9d0c-406b-ad77-b5ff29155f2b"},{"id":"481480d5-cf87-4122-900f-18307fe19a86","name":"Salesforce","targetId":"cba8d62d-9d0c-406b-ad77-b5ff29155f2b"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"cba8d62d-9d0c-406b-ad77-b5ff29155f2b"},{"id":"a41318b7-d0b8-4b39-8250-dbbad194e770","name":"MongoDB","targetId":"cba8d62d-9d0c-406b-ad77-b5ff29155f2b"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"cba8d62d-9d0c-406b-ad77-b5ff29155f2b"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cba8d62d-9d0c-406b-ad77-b5ff29155f2b"}],"recentChangeFlags":null},{"id":"211eb6bf-2d08-44f2-830d-d832a47f8d91","uri":"","name":"*.namequery.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4246b87b-9aba-4466-a85e-2fbb4e9d6664","sortOrder":0},"sortOrder":0,"tags":[{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"211eb6bf-2d08-44f2-830d-d832a47f8d91"},{"id":"86402f5d-20d0-4c88-92b9-0994786e4241","name":"C++","targetId":"211eb6bf-2d08-44f2-830d-d832a47f8d91"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"211eb6bf-2d08-44f2-830d-d832a47f8d91"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"211eb6bf-2d08-44f2-830d-d832a47f8d91"}],"recentChangeFlags":null},{"id":"27d4ad3d-b469-4740-9f77-37e67e0bf4c2","uri":"","name":"*.dnssearch.org","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"879c33f7-9847-4875-94cf-73074eb22e7c","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"27d4ad3d-b469-4740-9f77-37e67e0bf4c2"}],"recentChangeFlags":null},{"id":"be79b662-2e84-45c3-b6f3-1b2d8a69d83e","uri":"","name":"absolute.on.netmotioncloud.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"89e5ec11-e798-4ace-b91c-7626eafc5c2a","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"be79b662-2e84-45c3-b6f3-1b2d8a69d83e"}],"recentChangeFlags":null},{"id":"c148ff3c-9459-4554-b785-160e1895ff30","uri":"","name":"*.nmwco.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"edc9fed7-ed5c-4cd1-9ab3-ffa376593654","sortOrder":5},"sortOrder":5,"tags":null,"recentChangeFlags":null},{"id":"21a3d2e0-d662-434b-80ee-04fb108114fd","uri":"","name":"*.netmotionwireless.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"c84981bb-1a21-4437-8e91-5c628bb08311","sortOrder":6},"sortOrder":6,"tags":null,"recentChangeFlags":null},{"id":"6f0b8699-ccd3-4684-bc0e-55fda3f383cb","uri":"","name":"*.netmotionsoftware.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a0ab147b-9e1b-46db-a9e1-d42d0b6c8a53","sortOrder":7},"sortOrder":7,"tags":null,"recentChangeFlags":null},{"id":"f70f26ac-6773-4d12-ad9b-0b13646a15f1","uri":"","name":"*.qanmw.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1d26d480-70ba-4358-9e1b-d904cc5d8c11","sortOrder":8},"sortOrder":8,"tags":null,"recentChangeFlags":null},{"id":"0b5ce3d8-198d-4300-bf23-8df5131831aa","uri":"","name":"*.absopd.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5f364a58-ec3f-488c-ae9c-34a072a1efe8","sortOrder":9},"sortOrder":9,"tags":null,"recentChangeFlags":null},{"id":"b474343c-2c77-4ea0-9ae5-2a50873042cf","uri":"","name":"*.localitycloud.com","category":"other","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"39c162f0-61cb-48ee-a053-7a2366c5e19b","sortOrder":10},"sortOrder":10,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThe following are considered in scope:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003ePublic-facing Absolute Software web applications, APIs, and services listed on the engagement page.\u003c/li\u003e\n\u003cli\u003eDocumented SaaS interfaces associated with Absolute-branded services.\u003c/li\u003e\n\u003cli\u003eCloud or service components directly managed and operated by Absolute that are explicitly designated as in scope.\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"aac74a54-b65c-429e-8726-9ec4042ae600","code":"absolutesoftware-vdp-pro2","state":"in_progress","endsAt":null,"bountyId":"85fb8399-f905-487d-a4e5-cb75b7d510b9","startsAt":"2025-10-17T19:44:34Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":null,"methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/c4d5/f9d3/d83dea19/deb59cb1851b70ec63ca8e43801a1aae_Absolute_Software.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2025-10-17T19:44:34.174Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/absolutesoftware-vdp-pro2","changelogs":"/engagements/absolutesoftware-vdp-pro2/changelog","submissions":null,"announcements":"/engagements/absolutesoftware-vdp-pro2/announcements","hallOfFame":"/engagements/absolutesoftware-vdp-pro2/hall_of_fames","crowdstream":"/engagements/absolutesoftware-vdp-pro2/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/absolutesoftware-vdp-pro2/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=absolutesoftware-vdp-pro2\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/absolutesoftware-vdp-pro2/engagement_subscribers","engagementChangelogsUrl":"/engagements/absolutesoftware-vdp-pro2/changelog","publishedAt":"2026-07-22T14:37:29.710Z","engagementChangelogUrl":"/engagements/absolutesoftware-vdp-pro2/changelog/05bf79c8-a745-4071-8685-9425834d9ad2","createUserFeedbacksUrl":"/engagements/absolutesoftware-vdp-pro2/feedbacks","engagementCrowdstreamUrl":"/engagements/absolutesoftware-vdp-pro2/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}