Global Payments Vulnerability Disclosure Program on Hackerone

{ "allows_bounty_splitting": false, "average_time_to_bounty_awarded": null, "average_time_to_first_program_response": 1, "average_time_to_report_resolved": 516, "handle": "global-payments", "id": 0, "managed_program": true, "name": "Global Payments", "offers_bounties": false, "offers_swag": false, "response_efficiency_percentage": 98, "submission_state": "open", "url": "https://hackerone.com/global-payments", "website": "http://globalpayments.com", "targets": { "in_scope": [ { "asset_identifier": "Active Networks", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Specific domains managed by Active Networks such as teampages.com, activeclubsports.com, activeswim.com, beactivebefit.com, and jumpforward.com. **OUT OF SCOPE:**\n Domains including active.com and activenetwork.com are hosted on a 3rd party CDN and are out of scope.\n\nTesters cannot create their own events or teams to exploit cross site scripting vulnerabilities", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Analytics & Customer Engagement (ACE)", "asset_type": "SOURCE_CODE", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by ACE, such as heartlandordering.us, beanstalkdata.com, chockstone.com, beanstalkloyalty.com, and heartlandgiftcard.com are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Chargeback Help", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Comercia Global Payments ", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "URL - *comerciaglobalpayments.com", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "ECSI", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by ECSI, such as ecsi.net, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "EVO Payments, Inc. ", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "EVO Payments, Inc. is a fully integrated merchant acquirer and payment processor. Evo has an international presence that extends across the USA, Canada, Mexico and Europe. EVO Payments International GmbH is the European subsidiary of the EVO Group.\nThe target market for this company is POS resellers, Integrators and ISVs, B2B merchants and ERP integrators, SMB merchants and eCommerce integrated partners.\nPayment solutions include, standalone terminals, semi-integrated payments, online (gateways and web based payments solutions), value added programs and services, hosted solutions for developers, mobile, B2B and ERP integrations.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Ezidebit", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Ezidebit, such as ezidebit.com.au, ezidebit.com and getpayments.com, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "GP AUNZ", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Australia/New Zealand are in scope for this program", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "GP Integrated", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Integrated, such as globalpaymentsintegrated.com, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "GP Integrated - PayGateway", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Integrated related to Pay Gateway, such as paygateway.com and its subdomains are in scope for this program", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "GP eCom", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments eCom, such as addonpayments.com, elavonpaymentgateway.com, globaliris.com, globalpay-ecommerce.com, payandshop.com, realexpayments.com, realexplatform.com, rxdev.com, rxpplatorm.com, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "GPE", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Europe, such as gpe.cz, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Global Payments Integrated", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any other domains managed by Global Payments Integrated, such as x-charge.com, xgiftonline.com, giftbalance.info, or t3secure.net, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Globalpayments.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Findings on the Globalpayments.com domain are in scope for this program except where there is an exception in the asset inventory.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Greater Giving", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Greater giving, such as greatergiving.com, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Heartland Developer Portal", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Heartland Payment Systems", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Heartland Payment Systems are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Heartland Restaurant / Retail / Human Capital Management (Get Hired)", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Heartland Restaurant & Retail, such as digitaldining.com, dinerware.com, heartlandplusone.com, hlprd.com, hcomm.us, gethired.com, myspringboard.us, springboardretail.com, pcamerica.com, mobilebytes.com, businessviewglobal.com, heartlandpayroll.com, gpcheck.com, hpservicing.com, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Merchant Portal", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "MerchantWare", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Integrated related to MerchantWare \n\nURLs in scope:\nmerchantware.net\naccessaccountdetails.com ", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Micropayments", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Heartland Micropayments, such as heartlandmicropayments.com, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "MineralTree", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "MineralTree is an automated solution for the accounts payable process. Inspyrus and Regal Software are both MineralTree companies as well.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "My School Bucks", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Nextep", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Integrated related to Sicom, such as nextepsystems.com and nextepsystems.net are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "OpenEdge", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Integrated related to OpenEdge View, such as openedge.com and openedgeview.com are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Sentral", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Sentral, such as sentral.com.au, are in scope for this program.\n\n\nThe below domains are also included:\n*.nonprod.sentral.com.au and nextgen-whitehat-pen-testing.nonprod.sentral.com.au", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Storman", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments Storman, such as storman.com, storman.com.au, selfstoragesoftware.com.au, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "TSYS ", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "TouchNet", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Specific domains managed by Touchnet are in scope: test.secure.touchnet.net.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Vendara - Gateway", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Vendara provides omni-channel payment processing and financial technology (FinTech) services. The company specializes in facilitating secure, efficient transactions for merchants, Independent Sales Organizations (ISOs), agents, and Independent Software Vendors (ISVs). \n\nURL in Scope: \nGateway Frontend: https://webportalsandbox.choice.dev – Legacy UI for managing Proprietary gateway for CC processing.\n\nGateway API: https://sandbox.choice.dev Proprietary gateway for CC processing\n", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Vendara - Jarvis", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Vendara provides omni-channel payment processing and financial technology (FinTech) services. The company specializes in facilitating secure, efficient transactions for merchants, Independent Sales Organizations (ISOs), agents, and Independent Software Vendors (ISVs). \n\nJarvis is a CRM tool, It facilitates application through boarding of merchants and agents, as well as ongoing management.\n\nURL in Scope: \nhttps://webstage.jarvistec.com/", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "Vendara - Merchant Portal", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": " Vendara provides omni-channel payment processing and financial technology (FinTech) services. The company specializes in facilitating secure, efficient transactions for merchants, Independent Sales Organizations (ISOs), agents, and Independent Software Vendors (ISVs). \nURL in Scope:\n\n\nVendara’s Merchant Portal with Virtual Terminal. Helps Merchants with all aspects of CC processing and managing their transactions\n\nURL(s) in Scope: \nFrontend: https://bpweb-snd-next.choiceportal.xyz\nAPI: https://bpapi-snd-next.choiceportal.xyz", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "bleepplc.co.uk", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "developer.globalpay.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "eWay", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Any domains managed by Global Payments eWay, such as ewaypayments.com, eway.com.au, webactive.com.au, are in scope for this program.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "http://cloud-sbox.storman.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Storman's Cloud based storage operations management suite\nURL in Scope: cloud-sbox.storman.com", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "http://heartland.us", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "http://portal-staging.storman.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "Storman Portal is a companion to Storman Cloud, allowing end users to select their storage facility.\nURL in scope: portal-staging.storman.com", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "pcamerica.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "test.revaluemycard.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "testadmin.revaluemycard.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "testmobile.revaluemycard.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "testprovider.revaluemycard.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" } ], "out_of_scope": [ { "asset_identifier": "Heartland Payroll", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "Leaked Credentials", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "Xenial (Xenial)", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "Zego", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "remotesupport.heartland.us", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" } ] } }

Global Payments

In scope

Recent changes

Community reports

Your notes

Out of scope