Apple Updates Bug Bounty Program Q4

In recent years, Apple and the company around cupertino have received massive criticism about the current Bug Bounty program. Among other things, well-known security researchers from the scene have criticized Apple for a faulty program, which attracts others but never pays off. The reason for this was that Apple's bug bounty program was only open for private invitations. But now that Apple is confronted more and more with full disclosure and data protection failures as well as vulnerabilities that cannot be denied anymore, the internal program has to be revised in its methodology. Reasons for this are higher prices on black markets, penalties for data protection incidents and the publicly criticizing security researchers.

Telekom Magenta Musik 360 - CERT Coordinates

The videos shows the reproduce for the german telekom in a new service they did publish in 2019 Q1. The vulnerabilities are persistent and non-persistent cross site scripting issues within the front / backend of the online service. Remote attackers are able to inject own malicious script codes to the registration process in the exception handling. After the inject the malformed codes are as well exectuable in the backend against managers or administrators of the cms.

The security issues were reported to the telekom cz bug bounty and cert team. The issues was resolved within 2 weeks after the notify of the security contact. Feel free to preview the video of the identification process and reproduce.