"Zoom Paid Out $3.9 Million in Bug Bounties in 2022"

Video communications giant Zoom recently announced that in 2022 it paid out $3.9 million to security researchers who reported vulnerabilities as part of its bug bounty program.  Zoom launched a private bug bounty program on HackerOne in 2019 and has paid over $7 million in bounty rewards to date.  In 2021, the company paid roughly $1.8 million in bug bounty rewards.  The company noted that moving forward, they are working on implementing a new vulnerability impact scoring system that it will use alongside the Common Vulnerability Scoring System (CVSS) to score reports.  The new Vulnerability Impact Scoring System (VISS) will rank vulnerability reports based on 13 different aspects of their impact on Zoom’s infrastructure and technology, as well as on customer data security.  Zoom stated that with the implementation of VISS, Bug Bounty can focus more on measuring responsibly demonstrated impact rather than the theoretical possibility of exploitation.  The company has not mentioned how many vulnerabilities were reported last year and how many of these led to the release of a patch.  However, Zoom issued CVE identifiers for tens of critical and high severity flaws across its product portfolio.

SecurityWeek reports: "Zoom Paid Out $3.9 Million in Bug Bounties in 2022"