HEMAR Vulnerability Report

Use this template to describe a suspected vulnerability. This document does not
submit a report or send an email. Do not include credentials or unrelated personal
information. Follow the current HEMAR Vulnerability Disclosure Program when
choosing an approved reporting channel and handling confidential information.

Subject: [VULNERABILITY] <Affected product and concise issue title>

1. Reporter and organization
Organization:
Contact name:
Contact email:
Preferred contact method:

2. Affected product or service
Product / service:
Model:
Device source / acquisition channel:
Serial number (only if necessary for investigation):
Hardware version:
Operating system / software version:

3. Vulnerability summary
Issue description:
Vulnerability category:
Potential impact:
Estimated severity and reasoning:

4. Technical details
Prerequisites:
Reproduction steps:
Observed behavior:
Expected behavior:
Proof of concept / supporting evidence:
Attack scenario and required user interaction:

5. Suggested mitigation
Recommended mitigation:
Available workarounds:

6. Disclosure coordination
Date discovered:
Other parties already notified:
Relevant previous correspondence:

Do not assume that a public encryption key is available. Verify the recipient and
the current public key through the website administrator before sharing material
that requires encryption.