Visma delivers software that simplifies and digitizes core business processes in the private and public sector. With presence across the entire Nordic region along with Benelux, Central and Eastern Europe, we are one of Europe’s leading software companies. We want to engage with responsible security researchers around the globe to further secure our services. No code is flawless and we believe that taking part in the Intigriti community can help us improve the security of our systems. Vulnerabilities in any other Visma service, product or web property outside this program's domain scope are not eligible for bounties and should be reported to the Visma Responsible Disclosure program instead, you can find a link to the program in the 'In scope' info box below.
In order to gain a positive relationship and avoid misinterpretation and vagueness, we would like you to review the following program rules before you report a vulnerability. By participating in this program, you agree to respect our policy.
In connection with your participation in this program you agree to comply with all applicable local and national laws.
You may not participate in this program if you are currently employed or contracted by Visma.
You may not participate in this program if you are a resident or individual located within a country appearing on any U.S. or E.U. sanctions list.
Vulnerabilities obtained by exploiting Visma users or employees are not eligible for a bounty and will result in immediate disqualification from the program.
Visma has never given permission/authorization (either implied or explicit) to an individual or group of individuals to extract personal information or content of Visma's customers and publicize this information on the open, public-facing Internet without customer consent, nor has Visma ever given permission for programs or data belonging to Visma to be modified or corrupted in order to extract and publicly disclose data belonging to Visma.
Visma reserves the right to change this policy at any time. You can subscribe to program updates to be notified of any changes.
We are happy to announce the launch of our Public Bug Bounty Program on Intigriti, so if you have discovered a security vulnerability, please inform us through this program and we will do our best to quickly fix it.
We plan to continuously update our scope, so keep an eye on us or subscribe to our program to receive updates.
As stated in the program description vulnerabilities in any other Visma service, product or web property outside this program's domain scope are not eligible for bounties, please report them to our Visma Responsible Disclosure program instead.
Additionally to the below general out of scopes, please make sure you always check the asset description under each domain and don't submit issues that are out of scope for those specific domains.
In general, please do not submit issues regarding:
No impact means no bounty. We will always take into consideration the business impact and security impact when setting the final severity of the reports.
Monetary rewards will be offered for qualifying reports. The amount will vary depending on the severity. The "Bounties" section provides a general guideline for the amounts, but final rewards may be adjusted for actual business impact. For example an SQLi for a database containing no sensitive information may be rewarded a lower amount compared to an SQLi for a database with sensitive information.
We highly value good quality, actionable reports and that’s one of the the requirements for "Exceptional" severity category.
When duplicates occur, we will only accept the first report. A duplicate is a vulnerability that we are already aware of, regardless of how we first became aware of it (it could have also been discovered by us internally).
To get an idea of how we define severities, see the following table as a guideline:
| Severity | Vulnerability |
|---|---|
| Exceptional | A quality report that shows exceptional impact to Visma and it's customers, typically otherwise in high or critical severity category |
| Critical | Remote Code Execution (RCE) |
| Critical | SQL Injection (SQLi) |
| Critical | Authentication or Authorization Bypass |
| High | Local File Inclusion |
| High | Account Takeover |
| High | Mass PII Extraction |
| High | Horizontal Privilege Escalation across customer contexts |
| High | Vertical Privilege Escalation |
| High | XML External Entity Injection (XXE) |
| Medium | Insecure Direct Object Reference (IDOR) |
| Medium | Horizontal Privilege Escalation within the same customer context |
| Medium | Server-Side Request Forgery (SSRF) |
| Medium | Reflected Cross-Site Scripting |
| Medium | Stored Cross-Site Scripting (XSS) |
| Medium | DOM-based Cross-Site Scripting |
| Medium | Cross-Site Request Forgery (CSRF) |
| Medium | Sensitive Data Exposure |
| Medium | Cross-Site Script Inclusion (XSSI) |
| Low | GUID-based IDOR |
| Low | Mass User Enumeration (without brute-forcing) |
| Low | Clear text Submission of Passwords (over HTTP) |
| Low | Open Redirect |
| Low | HTML content injection |
| Low | Broken Link Hijacking |
| Low | Rate limit issues on authentication endpoints |
| Informative | Non-State Changing Cross-Site Request Forgery |
| Informative | CSV/formula injection |
| Informative | Server Information Page |
| Informative | User Enumeration including WordPress Mass User Enumeration |
| Out of scope | Text (non-html) content injection |
| Out of scope | Non-Sensitive Data Disclosure |
| Out of scope | Lack of, or weak, security headers |
| Out of scope | Flash based CSRF |
| Out of scope | DoS & DDoS |
You can self-register on the application, but please don’t forget to use your @intigriti.me address. For more details, please read each asset description.
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.
