{"id":"0c128438-aeab-43c6-beaa-eac69c211589","engagementId":"d088b86a-c7e6-42c2-b295-094b8a62afc5","data":{"brief":{"id":"3da947eb-2f9e-4d52-bc1e-14e5c5e64c7d","name":"Village Roadshow Vulnerability Disclosure Program","tagline":"Village Roadshow Vulnerability Disclosure Program","description":"\u003ch1\u003e\u003cstrong\u003eProgram Details\u003c/strong\u003e\u003c/h1\u003e\n\n\u003cp\u003eVillage Roadshow, founded in 1954 in Melbourne, Australia, is a leading entertainment company with a diverse portfolio of assets including theme parks, cinema exhibitions, film distribution, marketing solutions, and film production. With over 5,000 employees across key locations, it entertains millions annually.\u003c/p\u003e\n\n\u003cp\u003eVRL takes the protection of its information, systems, and networks very seriously. We are implementing this Vulnerability Disclosure Program with the intent of removing or mitigating the potential impact(s) of security vulnerabilities that may exist on our systems or networks. We value the unique opportunity that this Program affords in engaging with the broader security research community to strengthen the security of our systems and networks.\u003c/p\u003e","industryTagId":"ef2b9ee7-7f73-4978-9530-ad18bbf3f902","targetsOverview":"\u003ch1\u003e\u003cstrong\u003eRatings\u003c/strong\u003e\u003c/h1\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal and make a case for a higher priority.\u003c/p\u003e\n\n\u003ch1\u003e\u003cstrong\u003eTesting Information\u003c/strong\u003e\u003c/h1\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eTargets are public facing.\u003c/li\u003e\n\u003cli\u003eThe use of personal credentials, your own or discovered, for testing purposes is strictly prohibited. This program is set up as an unauthenticated program. If you have any questions regarding this matter, please contact support@bugcrowd.com.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eIn-Scope\u003c/h2\u003e\n\n\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of VRL not listed in the targets section is out of scope. This includes any/all subdomains not listed in the targets section. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to VRL, you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003cbr\u003e\nVRL uses third-party services that may be on our subdomains. These are out-of-scope for this program. VRL cannot authorize testing on systems or networks we don't own. Researchers can decide whether to report issues with these services to the relevant third party. However, if you think an issue is due to VRL's misconfiguration or insecure use, or if it affects many customers and VRL can temporarily mitigate it, please report it to us.\u003c/p\u003e\n\n\u003ch1\u003e\u003cstrong\u003eRules of Engagement\u003c/strong\u003e\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll submissions should be from your @bugcrowdninja.com email address.\u003c/li\u003e\n\u003cli\u003eUse your best efforts to avoid privacy violations, destruction of data, and interruption or degradation of any VRL services, systems, or networks.\u003c/li\u003e\n\u003cli\u003eDo not conduct non-technical attacks such as social engineering, phishing, or unauthorised access to VRL systems, networks, or infrastructure.\u003c/li\u003e\n\u003cli\u003eDo not modify any data or information\u003c/li\u003e\n\u003cli\u003eDo not in any way attack our customers or end users or use stolen/breached user credentials.\u003c/li\u003e\n\u003cli\u003eResearchers will not pursue post-exploitation unless explicitly approved by VRL.\u003c/li\u003e\n\u003cli\u003eThe use of automated scanning tools is prohibited. \u003c/li\u003e\n\u003cli\u003eRecursive DNS enumeration should be kept to a minimum. \u003c/li\u003e\n\u003cli\u003eVRL will not accept generic vulnerability scan results without working proof of exploit or a clear path to exploitation of a vulnerability.\u003c/li\u003e\n\u003cli\u003eTools that may result in a Denial of Service (DoS) are prohibited.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003e\u003cstrong\u003eOut-of-Scope\u003c/strong\u003e\u003c/h1\u003e\n\n\u003cul\u003e\n\u003cli\u003eAny external-hosted environment that does not resolve to VRL’s DNS or IP address Ranges. Please be sure to check domain records and IP address registrations to confirm VRL ownership; do not test systems or targets not owned or controlled by VRL.\u003c/li\u003e\n\u003cli\u003eOut-of-Scope vulnerabilities include, but are not limited to:\u003c/li\u003e\n\u003cli\u003eSelf XSS\u003c/li\u003e\n\u003cli\u003eOut-of-date software (without an exploitable PoC)\u003c/li\u003e\n\u003cli\u003eAutomated Scans report (without an exploitable PoC.) For example, submitting known vulnerable versions Apache or PHP with no reproducible steps to prove an actual exploit are OOS.\u003c/li\u003e\n\u003cli\u003eContent Spoofing Vulnerabilities\u003c/li\u003e\n\u003cli\u003eDNS configuration related issues\u003c/li\u003e\n\u003cli\u003eHost Header Injection (without providing an exploitable scenario)\u003c/li\u003e\n\u003cli\u003eHTTP Trace method is enabled\u003c/li\u003e\n\u003cli\u003eIssues present only in older versions of browsers, plugins, or any other software\u003c/li\u003e\n\u003cli\u003eLow Impact CSRF issues, including but not limited to login and Logout CSRF\u003c/li\u003e\n\u003cli\u003eLow Severity Clickjacking Vulnerabilities\u003c/li\u003e\n\u003cli\u003eMissing Rate Limiting Protections (unless corresponding to authentication flow)\u003c/li\u003e\n\u003cli\u003eMissing Security Headers and Cookie Flags, which can’t be exploited by themselves (for example Strict-Transport-Security, HTTPOnly)\u003c/li\u003e\n\u003cli\u003eServer Configuration related issues that are not exploitable\u003c/li\u003e\n\u003cli\u003eSocial engineering and phishing attacks\u003c/li\u003e\n\u003cli\u003eSpam e-mail (missing rate limiting protections)\u003c/li\u003e\n\u003cli\u003eSSL vulnerabilities related to configuration, version, weak ciphers (without a working exploit)\u003c/li\u003e\n\u003cli\u003eUse of a vulnerable 3rd party library/code snippet (without providing an exploitable scenario)\u003c/li\u003e\n\u003cli\u003eInfo.php (without providing an exploitable scenario)\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch1\u003e\u003cstrong\u003eConfidentiality\u003c/strong\u003e\u003c/h1\u003e\n\n\u003cp\u003eYou must treat all information or data about or on our systems, staff or users that comes into your possession or that you otherwise become aware of, which is not publicly available, as strictly confidential, and not share or otherwise use it for any purpose other than emailing it to us as a submission as described above. You are expected, as always, to comply at all times with all applicable laws and with the Bugcrowd Standard Disclosure Terms - \u003ca href=\"https://www.bugcrowd.com/resources/essentials/standard-disclosure-terms/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eStandard Disclosure Terms | Bugcrowd.\u003c/a\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"118ab73b-2992-48c1-942a-2fff2c270c47","name":"In Scope Targets","targets":[{"id":"ddabcb67-33b6-472e-b710-0687f5cc7942","uri":"https://vrl.com.au","name":"*.vrl.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"3de95aeb-9779-4388-b869-aca66261e357","sortOrder":0},"sortOrder":0,"tags":[{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"ddabcb67-33b6-472e-b710-0687f5cc7942"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ddabcb67-33b6-472e-b710-0687f5cc7942"}],"recentChangeFlags":null},{"id":"78f4d972-105a-40b3-af49-0bc426787213","uri":"https://*.vrtp.com.au","name":"*.vrtp.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"4c6d3c64-7781-4ac6-85f7-3e5f63178e48","sortOrder":1},"sortOrder":1,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"78f4d972-105a-40b3-af49-0bc426787213"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"78f4d972-105a-40b3-af49-0bc426787213"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"78f4d972-105a-40b3-af49-0bc426787213"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"78f4d972-105a-40b3-af49-0bc426787213"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"78f4d972-105a-40b3-af49-0bc426787213"}],"recentChangeFlags":null},{"id":"af460e6d-4064-4b29-a9f5-353da8bcb8b4","uri":"https://roadshow.com.au","name":"*.roadshow.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"11500752-be37-4612-85e0-9d1b6c32e4b6","sortOrder":2},"sortOrder":2,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"af460e6d-4064-4b29-a9f5-353da8bcb8b4"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"af460e6d-4064-4b29-a9f5-353da8bcb8b4"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"af460e6d-4064-4b29-a9f5-353da8bcb8b4"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"af460e6d-4064-4b29-a9f5-353da8bcb8b4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"af460e6d-4064-4b29-a9f5-353da8bcb8b4"},{"id":"dd477d24-b394-460d-aaf7-9bd213555968","name":"Ruby","targetId":"af460e6d-4064-4b29-a9f5-353da8bcb8b4"}],"recentChangeFlags":null},{"id":"c767eb27-a226-4455-babd-8a1d0be9d1c4","uri":"https://topgolf.com.au","name":"*.topgolf.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"98289064-8fb3-415e-ada6-91f8013141aa","sortOrder":3},"sortOrder":3,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"c767eb27-a226-4455-babd-8a1d0be9d1c4"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"c767eb27-a226-4455-babd-8a1d0be9d1c4"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"c767eb27-a226-4455-babd-8a1d0be9d1c4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c767eb27-a226-4455-babd-8a1d0be9d1c4"},{"id":"e8a0921a-8c3b-463d-af43-8dbdc6b1c03d","name":"NodeJS","targetId":"c767eb27-a226-4455-babd-8a1d0be9d1c4"}],"recentChangeFlags":null},{"id":"894a10a1-9455-4e03-b907-2e8ac0782c7f","uri":"https://villagecinemas.com.au","name":"*.villagecinemas.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f4edba61-3169-4430-ad28-84842384520a","sortOrder":4},"sortOrder":4,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"894a10a1-9455-4e03-b907-2e8ac0782c7f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"894a10a1-9455-4e03-b907-2e8ac0782c7f"}],"recentChangeFlags":null},{"id":"a07d04e8-397b-40b9-8f34-3031eae0bae8","uri":"https://intencity.com.au","name":"*.intencity.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"85d31b55-4e53-48c8-b1bb-9b484fe7dfe6","sortOrder":5},"sortOrder":5,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"a07d04e8-397b-40b9-8f34-3031eae0bae8"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"a07d04e8-397b-40b9-8f34-3031eae0bae8"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a07d04e8-397b-40b9-8f34-3031eae0bae8"}],"recentChangeFlags":null},{"id":"448bf504-7ad0-42bc-9bfd-0aca035b78a4","uri":"https://wetnwild.com.au","name":"*.wetnwild.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"1f7b4858-e0a7-411b-88cd-1eb16ea15279","sortOrder":6},"sortOrder":6,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"448bf504-7ad0-42bc-9bfd-0aca035b78a4"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"448bf504-7ad0-42bc-9bfd-0aca035b78a4"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"448bf504-7ad0-42bc-9bfd-0aca035b78a4"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"448bf504-7ad0-42bc-9bfd-0aca035b78a4"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"448bf504-7ad0-42bc-9bfd-0aca035b78a4"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"448bf504-7ad0-42bc-9bfd-0aca035b78a4"}],"recentChangeFlags":null},{"id":"77aeaecd-f91b-4d18-8d84-5756aa3f7821","uri":"https://themeparks.com.au","name":"*.themeparks.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"ca176478-9adc-49e5-acce-c28e42ba5585","sortOrder":7},"sortOrder":7,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"77aeaecd-f91b-4d18-8d84-5756aa3f7821"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"77aeaecd-f91b-4d18-8d84-5756aa3f7821"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"77aeaecd-f91b-4d18-8d84-5756aa3f7821"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"77aeaecd-f91b-4d18-8d84-5756aa3f7821"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"77aeaecd-f91b-4d18-8d84-5756aa3f7821"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"77aeaecd-f91b-4d18-8d84-5756aa3f7821"}],"recentChangeFlags":null},{"id":"e9303b68-d265-469c-b20c-ea0f0588ef9e","uri":"https://outbackspectacular.com.au","name":"*.outbackspectacular.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"f53a408f-ea1e-4767-91dd-57bd7ce96647","sortOrder":8},"sortOrder":8,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"e9303b68-d265-469c-b20c-ea0f0588ef9e"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"e9303b68-d265-469c-b20c-ea0f0588ef9e"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"e9303b68-d265-469c-b20c-ea0f0588ef9e"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"e9303b68-d265-469c-b20c-ea0f0588ef9e"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"e9303b68-d265-469c-b20c-ea0f0588ef9e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e9303b68-d265-469c-b20c-ea0f0588ef9e"}],"recentChangeFlags":null},{"id":"ce546bf3-6fa8-45c3-928d-f16520c4c49e","uri":"https://paradisecountry.com.au","name":"*.paradisecountry.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e35f4887-e49b-469a-84b0-13aceceaf248","sortOrder":9},"sortOrder":9,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"ce546bf3-6fa8-45c3-928d-f16520c4c49e"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"ce546bf3-6fa8-45c3-928d-f16520c4c49e"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"ce546bf3-6fa8-45c3-928d-f16520c4c49e"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"ce546bf3-6fa8-45c3-928d-f16520c4c49e"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"ce546bf3-6fa8-45c3-928d-f16520c4c49e"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ce546bf3-6fa8-45c3-928d-f16520c4c49e"}],"recentChangeFlags":null},{"id":"b86decc2-fa15-4ce0-a258-c1bcf47088a7","uri":"https://seaworldresort.com.au","name":"*.seaworldresort.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"e4e8230a-9e82-4f00-8b1e-6a3890d069f3","sortOrder":10},"sortOrder":10,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"b86decc2-fa15-4ce0-a258-c1bcf47088a7"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"b86decc2-fa15-4ce0-a258-c1bcf47088a7"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"b86decc2-fa15-4ce0-a258-c1bcf47088a7"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"b86decc2-fa15-4ce0-a258-c1bcf47088a7"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"b86decc2-fa15-4ce0-a258-c1bcf47088a7"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b86decc2-fa15-4ce0-a258-c1bcf47088a7"}],"recentChangeFlags":null},{"id":"d41e2e85-f14e-45ef-9c38-74a5b99b54d7","uri":"https://seaworld.com.au","name":"*.seaworld.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"cac159d4-9ca0-4fbe-86a4-82e4e8c50839","sortOrder":11},"sortOrder":11,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"d41e2e85-f14e-45ef-9c38-74a5b99b54d7"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"d41e2e85-f14e-45ef-9c38-74a5b99b54d7"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"d41e2e85-f14e-45ef-9c38-74a5b99b54d7"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"d41e2e85-f14e-45ef-9c38-74a5b99b54d7"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"d41e2e85-f14e-45ef-9c38-74a5b99b54d7"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d41e2e85-f14e-45ef-9c38-74a5b99b54d7"}],"recentChangeFlags":null},{"id":"e76a44e7-147e-4b4a-b394-11cd9719e417","uri":"https://seaworldcarnivale.com.au","name":"*.seaworldcarnivale.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"9b0ad09f-d717-4431-a8e1-42d881bb9e24","sortOrder":12},"sortOrder":12,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"e76a44e7-147e-4b4a-b394-11cd9719e417"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"e76a44e7-147e-4b4a-b394-11cd9719e417"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"e76a44e7-147e-4b4a-b394-11cd9719e417"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"e76a44e7-147e-4b4a-b394-11cd9719e417"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e76a44e7-147e-4b4a-b394-11cd9719e417"}],"recentChangeFlags":null},{"id":"c88a1704-db9c-4b28-acbd-bbee36fd415d","uri":"https://movieworld.com.au","name":"*.movieworld.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"af15fb2d-6696-4de0-9e88-8f93960d7b4e","sortOrder":13},"sortOrder":13,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"c88a1704-db9c-4b28-acbd-bbee36fd415d"},{"id":"624f911d-7e8c-4d56-b523-e7416c1cc319","name":"NextJS","targetId":"c88a1704-db9c-4b28-acbd-bbee36fd415d"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"c88a1704-db9c-4b28-acbd-bbee36fd415d"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"c88a1704-db9c-4b28-acbd-bbee36fd415d"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c88a1704-db9c-4b28-acbd-bbee36fd415d"}],"recentChangeFlags":null},{"id":"8e6b43fa-6185-4389-b25b-d8e7654fd278","uri":"https://whitechristmas.com.au","name":"*.whitechristmas.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"82adb24e-fe36-4279-936d-97facb0b00aa","sortOrder":14},"sortOrder":14,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"8e6b43fa-6185-4389-b25b-d8e7654fd278"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"8e6b43fa-6185-4389-b25b-d8e7654fd278"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"8e6b43fa-6185-4389-b25b-d8e7654fd278"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"8e6b43fa-6185-4389-b25b-d8e7654fd278"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"8e6b43fa-6185-4389-b25b-d8e7654fd278"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8e6b43fa-6185-4389-b25b-d8e7654fd278"}],"recentChangeFlags":null},{"id":"da0dbe68-b8b9-4506-993e-ca71bdf688a1","uri":"https://roadshowroughdiamond.com","name":"*.roadshowroughdiamond.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5ebfb60d-b933-4e1f-89f7-90377085c72c","sortOrder":15},"sortOrder":15,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"da0dbe68-b8b9-4506-993e-ca71bdf688a1"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"da0dbe68-b8b9-4506-993e-ca71bdf688a1"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"da0dbe68-b8b9-4506-993e-ca71bdf688a1"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"da0dbe68-b8b9-4506-993e-ca71bdf688a1"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"da0dbe68-b8b9-4506-993e-ca71bdf688a1"}],"recentChangeFlags":null},{"id":"009674ed-5b5e-4cb2-9f72-7ca6628dee5a","uri":"https://frightnights.com.au","name":"*.frightnights.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"56c566f7-6ccc-4830-a992-a7e25742180a","sortOrder":16},"sortOrder":16,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"009674ed-5b5e-4cb2-9f72-7ca6628dee5a"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"009674ed-5b5e-4cb2-9f72-7ca6628dee5a"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"009674ed-5b5e-4cb2-9f72-7ca6628dee5a"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"009674ed-5b5e-4cb2-9f72-7ca6628dee5a"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"009674ed-5b5e-4cb2-9f72-7ca6628dee5a"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"d088b86a-c7e6-42c2-b295-094b8a62afc5","code":"village-roadshow-vdp-pro","state":"in_progress","endsAt":null,"bountyId":"bdca6df1-9a5e-474e-bd84-f192b72fcc1f","startsAt":"2024-07-30T18:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Entertainment","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/b0c7/462a/b4cefa82/ea12681bd2772de5385c57469de2e2a6_1631326643662.jpeg","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-07-30T18:00:00.100Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/village-roadshow-vdp-pro","changelogs":"/engagements/village-roadshow-vdp-pro/changelog","submissions":null,"announcements":"/engagements/village-roadshow-vdp-pro/announcements","hallOfFame":"/engagements/village-roadshow-vdp-pro/hall_of_fames","crowdstream":"/engagements/village-roadshow-vdp-pro/crowdstream"},"announcementsCount":1,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/village-roadshow-vdp-pro/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=village-roadshow-vdp-pro\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/village-roadshow-vdp-pro/engagement_subscribers","engagementChangelogsUrl":"/engagements/village-roadshow-vdp-pro/changelog","publishedAt":"2024-09-19T05:57:39.052Z","engagementChangelogUrl":"/engagements/village-roadshow-vdp-pro/changelog/0c128438-aeab-43c6-beaa-eac69c211589","createUserFeedbacksUrl":"/engagements/village-roadshow-vdp-pro/feedbacks","engagementCrowdstreamUrl":"/engagements/village-roadshow-vdp-pro/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}