{"id":"f2e4e2fd-1a50-41f2-af8f-e15eb10d44c9","engagementId":"7a4f31f0-5fb1-4236-b7db-29c283afa15c","data":{"brief":{"id":"69cf63f2-2cb9-4ccb-9271-097c55a5275e","name":"Lenovo Responsible Disclosure","tagline":"As a global personal technology company, Lenovo develops, manufactures, and markets reliable, high-quality, secure and easy-to-use technology products and services.","description":"\u003cp\u003eWe appreciate all security concerns brought forth and are constantly striving to keep on top of the latest threats. Being pro-active rather than re-active to emerging security issues is a fundamental belief at Lenovo.\u003c/p\u003e\n\n\u003cp\u003eEvery day new security issues and attack vectors are created. Lenovo strives to keep abreast on the latest state-of-the-art security developments by working with security researchers and companies. We appreciate the community's efforts in creating a more secure world. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003cp\u003eRatings:\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eLenovo will rely on the \u003ca href=\"https://bugcrowd.com/vrt\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for prioritization of findings, but reserve the right to either downgrade or upgrade findings’ severity based on the criticality of their underlying risk to Lenovo. Any downgraded submission with come with a detailed explanation.\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003ePlease be aware this is a kudos-only program; no monetary rewards will be disbursed for this program.\u003c/em\u003e\u003c/p\u003e","industryTagId":null,"targetsOverview":"\u003ch2\u003eProgram Rules\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eIMPORTANT: Vulnerability reports on the exact same vulnerability across different target apps belonging to this program are not eligible for rewards. Please submit a single report.\u003c/strong\u003e\u003c/p\u003e\n\n\u003ch2\u003eTarget Details:\u003c/h2\u003e\n\n\u003cp\u003eThe Lenovo Responsible Disclosure program includes web sites from both Lenovo and Motorola Mobility. Key focus areas for this program include shopping cart manipulation and integrity, Confidentiality of customer data / PII, significant authentication bypass, and remote code execution.\u003c/p\u003e\n\n\u003cp\u003eWeb sites under *.lenovo.com and *.motorola.com are in scope, as are lenovo.com.* and motorola.com.* - as are web sites that are tied to specific country code top level domains (for example, lenovo.com.au or motorola.com.br).\u003cbr\u003e\n​\u003cbr\u003e\nThis program may also accept reports for vulnerabilities in other web sites that can be confirmed as being owned by Lenovo, even if they are not explicitly mentioned above.  For web sites that are not in the list above, please provide evidence for why you believe that the web site is owned by Lenovo (for example, through whois records).  Note that there may be independent repair centers or retail stores that use \"Lenovo\" in their domain name or on their web site, but this is not an indication that a web site is owned by Lenovo.  The program owners reserve the right to make the final decision on whether an asset is considered in-scope.\u003c/p\u003e\n\n\u003ch2\u003eGeneral Guidelines:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePlease use common sense, and do not blindly interact with forms or submit input that can have a negative impact on production web sites (such as submitting spam/noise in public comments, etc.)\u003c/li\u003e\n\u003cli\u003eAvoid privacy violations, destruction of data, and interruption or degradation of our services.\u003c/li\u003e\n\u003cli\u003eDo not modify, access, or retain data that does not belong to you.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e**Please review the Lenovo program \u003ca href=\"https://tracker.bugcrowd.com/lenovo\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ebounty brief\u003c/a\u003e with your submission to make sure it is applicable for a reward.\u003c/p\u003e\n\n\u003ch3\u003eTest Accounts\u003c/h3\u003e\n\n\u003cp\u003eTest accounts for researchers are not provided at this time.  Researchers may choose to self-register and authenticate to further interact with in-scope web sites if the web site allows self registration. \u003c/p\u003e\n\n\u003ch2\u003eOut-of-Scope:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eVulnerabilities related to Lenovo or Motorola products, PC applications, or mobile applications are out of scope.\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"dbb36541-b54b-46dd-bf4f-8c983d08483f","name":"In scope","targets":[{"id":"f52a2f38-495f-417d-a1c4-57a133d77969","uri":null,"name":"*.motorola.com.br","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"58f52b4b-16e4-4515-9a54-459412e26cf1","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"f52a2f38-495f-417d-a1c4-57a133d77969"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"f52a2f38-495f-417d-a1c4-57a133d77969"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"f52a2f38-495f-417d-a1c4-57a133d77969"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"f52a2f38-495f-417d-a1c4-57a133d77969"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"f52a2f38-495f-417d-a1c4-57a133d77969"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"f52a2f38-495f-417d-a1c4-57a133d77969"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f52a2f38-495f-417d-a1c4-57a133d77969"}],"recentChangeFlags":null},{"id":"80106a9a-859a-4805-bf83-129b110a1b31","uri":null,"name":"*.motorola.com.cn","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0afc8f21-a93a-4969-90ed-fc7ee55df916","sortOrder":0},"sortOrder":0,"tags":[{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"80106a9a-859a-4805-bf83-129b110a1b31"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"80106a9a-859a-4805-bf83-129b110a1b31"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"80106a9a-859a-4805-bf83-129b110a1b31"}],"recentChangeFlags":null},{"id":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723","uri":null,"name":"*.motorola.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8f249406-3be4-4a92-91d8-413be82bbd8a","sortOrder":0},"sortOrder":0,"tags":[{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723"},{"id":"9f26f47e-4acd-4d8d-aad2-414b6b367eb0","name":"Handlebars","targetId":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723"},{"id":"ce8ff3cd-4d54-4404-8321-6351781551a3","name":"Vue.js","targetId":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723"},{"id":"fbcf3656-e6af-403a-a14e-6ec830fb8668","name":"Javascript","targetId":"f4e7fcfc-a67e-4d6b-bdfe-192e4e912723"}],"recentChangeFlags":null},{"id":"727d97e3-cf1b-403c-8f49-9700b720872e","uri":null,"name":"*.lenovo.com.cn","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a5f09ec8-208e-40a0-9389-e8499e682795","sortOrder":0},"sortOrder":0,"tags":[{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"727d97e3-cf1b-403c-8f49-9700b720872e"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"727d97e3-cf1b-403c-8f49-9700b720872e"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"727d97e3-cf1b-403c-8f49-9700b720872e"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"727d97e3-cf1b-403c-8f49-9700b720872e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"727d97e3-cf1b-403c-8f49-9700b720872e"}],"recentChangeFlags":null},{"id":"121b2a83-2f84-41f1-81e1-6a4b3f4a42e0","uri":null,"name":"*.lenovo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b054dfe3-35d4-4e7c-8f9a-4bb25fa8184b","sortOrder":0},"sortOrder":0,"tags":[{"id":"08e84ba6-1e84-4c11-b559-a3b3b963546f","name":"Akamai CDN","targetId":"121b2a83-2f84-41f1-81e1-6a4b3f4a42e0"},{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"121b2a83-2f84-41f1-81e1-6a4b3f4a42e0"},{"id":"6481be19-8d64-4bb2-8426-2f1f7afe32e6","name":"Modernizr","targetId":"121b2a83-2f84-41f1-81e1-6a4b3f4a42e0"},{"id":"9f26f47e-4acd-4d8d-aad2-414b6b367eb0","name":"Handlebars","targetId":"121b2a83-2f84-41f1-81e1-6a4b3f4a42e0"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"121b2a83-2f84-41f1-81e1-6a4b3f4a42e0"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"121b2a83-2f84-41f1-81e1-6a4b3f4a42e0"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"121b2a83-2f84-41f1-81e1-6a4b3f4a42e0"}],"recentChangeFlags":null},{"id":"76ea0182-e427-464e-847b-4bdacfe41537","uri":null,"name":"*. lenovomm.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6d906a80-c04b-46f7-9a09-695631fda835","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"76ea0182-e427-464e-847b-4bdacfe41537"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"7a4f31f0-5fb1-4236-b7db-29c283afa15c","code":"lenovoresponsibledisclosure","state":"in_progress","endsAt":null,"bountyId":"b591c4d8-267a-4816-9c83-5446efa609d8","startsAt":"2018-04-12T17:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":null,"methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/bd92/3d05/3b0cdd99/5603b6e016ae78f33a78746206aa0f15_Untitled.jpg","logoBackgroundColor":"#E02625","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2018-04-12T17:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/lenovoresponsibledisclosure","changelogs":"/engagements/lenovoresponsibledisclosure/changelog","submissions":null,"announcements":"/engagements/lenovoresponsibledisclosure/announcements","hallOfFame":"/engagements/lenovoresponsibledisclosure/hall_of_fames","crowdstream":null},"announcementsCount":1,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/lenovoresponsibledisclosure/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=lenovoresponsibledisclosure\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/lenovoresponsibledisclosure/engagement_subscribers","engagementChangelogsUrl":"/engagements/lenovoresponsibledisclosure/changelog","publishedAt":"2020-04-08T19:15:03.690Z","engagementChangelogUrl":"/engagements/lenovoresponsibledisclosure/changelog/f2e4e2fd-1a50-41f2-af8f-e15eb10d44c9","createUserFeedbacksUrl":"/engagements/lenovoresponsibledisclosure/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}