Remote code execution in cdnjs of Cloudflare

Re:Remote code execution in cdnjs of Cloudflare by brainzap on Friday July 16, 2021 @03:31AM (#27853820)

How much was paid out?

[ Parent | on HN ]

Re:Remote code execution in cdnjs of Cloudflare by ortekk on Friday July 16, 2021 @07:21AM (#27855119)

$0. Their page on Hackerone is a "Vulnerability Disclosure Program", not "Bug Bounty Program".

[ Parent | on HN ]

Re:Remote code execution in cdnjs of Cloudflare by miou on Friday July 16, 2021 @07:55AM (#27855338)

It is possible they received a reward, it just isn't publicized.

"The decision to pay a reward is entirely at our discretion. You must not violate any law. You are responsible for any tax implications or additional restrictions depending on your country and local law. We reserve the right to cancel this program at any time."

(https://www.cloudflare.com/disclosure/)

[ Parent | on HN ]

Re:Remote code execution in cdnjs of Cloudflare by lima on Friday July 16, 2021 @07:42AM (#27855263)

Cloudflare, in some ways, still has a startup mindset when it comes to security and operations (both in good and bad ways).

[ Parent | on HN ]

Re:Remote code execution in cdnjs of Cloudflare by swiley on Friday July 16, 2021 @07:55AM (#27855339)

But they're terminating people's TLS?

[ Parent | on HN ]