{"id":"886cd6f2-3a41-4c5d-91df-03cc7f4cc118","engagementId":"2922702d-b156-487d-bd07-81139959bff5","data":{"brief":{"id":"fe997e27-e40e-421d-860f-ae7016e039be","name":"Deutsche Bank Vulnerability Disclosure Program","tagline":"German multinational investment bank and financial services company. ","description":"\u003cp\u003eNo technology is perfect and Deutsche Bank believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will be using the \u003ca href=\"https://nvd.nist.gov/vuln-metrics/cvss\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eCommon Vulnerability Scoring System (CVSS)\u003c/a\u003e However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be given to the researcher.\u003c/em\u003e\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eBugcrowd VRT Severity\u003c/th\u003e\n\u003cth\u003eBase CVSS Score Range\u003c/th\u003e\n\u003cth\u003eDB Rating\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eP4\u003c/td\u003e\n\u003ctd\u003e0.1 - 3.9\u003c/td\u003e\n\u003ctd\u003eTC4\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP3\u003c/td\u003e\n\u003ctd\u003e4.0 - 6.9\u003c/td\u003e\n\u003ctd\u003eTC3\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP2\u003c/td\u003e\n\u003ctd\u003e7.0 - 8.9\u003c/td\u003e\n\u003ctd\u003eTC2\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eP1\u003c/td\u003e\n\u003ctd\u003e9.0 - 10.0\u003c/td\u003e\n\u003ctd\u003eTC1\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cp\u003eA submission that would be a P5 when applying the VRT will still be considered a P5 on the program. \u003c/p\u003e","industryTagId":"b3d6ff0b-119e-4f5b-9c38-ee13f125fc52","targetsOverview":"\u003ch2\u003eCredentials:\u003c/h2\u003e\n\n\u003cp\u003eCurrently this program is running as non-authenticated. If you were to utilize credentials that you own it could result in your account being locked out as fraud. \u003cstrong\u003eIt is highly recommended that you should not use your Deutsche Bank account if you have one.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eRestricted Locations and Eligibility\u003c/h2\u003e\n\n\u003cp\u003eSecurity Researchers shall not be located in any of the following countries: Cuba, Iran, North Korea, Sudan, Syria, or the Crimea Region of the Ukraine. Venezuela, Belarus, Ukrainian regions occupied by Russia: Lughansk, Donetsk, Kherson, Zaporizhzhia, Russia.\u003c/p\u003e\n\n\u003cp\u003eFor UK \u0026amp; Germany, no subcontractors/freelancers/non vendor employees would be allowed irrespective of the type of the contract, due to IR35 \u0026amp; Merlin regulations\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"ac228941-1ee4-4450-8023-b078d4205025","name":"In Scope Targets","targets":[{"id":"86b779b5-88f8-4ee5-8797-e9dc6e0a7ad1","uri":"","name":"Any Deutsche Bank Asset","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"824ca6e1-6460-4cde-8c05-e2cae068ab57","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null},{"id":"be97bf9f-0e1d-4ceb-bc40-05f580d610b4","name":"Out of scope ","targets":[{"id":"0f44dd0c-8e11-4868-8492-3c397aec3e81","uri":"","name":"Trackit DB","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"96d0670b-f3fa-453d-a62c-e88085bf57de","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0f44dd0c-8e11-4868-8492-3c397aec3e81"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"2922702d-b156-487d-bd07-81139959bff5","code":"deutschebank-vdp","state":"in_progress","endsAt":null,"bountyId":"2a828e3d-ea19-467e-98fe-7030c4b42928","startsAt":"2020-02-04T19:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Banking","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/ecdb/0a9b/f53e4906/cba8fba44cc8fbb41d9fef71e7184e5c_deutschebank.jpeg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2020-02-04T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/deutschebank-vdp","changelogs":"/engagements/deutschebank-vdp/changelog","submissions":null,"announcements":"/engagements/deutschebank-vdp/announcements","hallOfFame":"/engagements/deutschebank-vdp/hall_of_fames","crowdstream":"/engagements/deutschebank-vdp/crowdstream"},"announcementsCount":8,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Priority Triage","submitReportUrl":"/engagements/deutschebank-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=deutschebank-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/deutschebank-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/deutschebank-vdp/changelog","publishedAt":"2026-04-24T16:35:36.991Z","engagementChangelogUrl":"/engagements/deutschebank-vdp/changelog/886cd6f2-3a41-4c5d-91df-03cc7f4cc118","createUserFeedbacksUrl":"/engagements/deutschebank-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/deutschebank-vdp/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}