HexBrain
Sign in

Browse / 8x8

8x8

91disclosed reports
$9,788paid in bounties

See its reports on the map

What gets reported to 8x8

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. connect.8x8.com/api/v1: JWT Algorithm Confusion VulnerabilityImproper Verification of Cryptographic Signature · high
    $1,337111 votes
  2. Stored xss at https://█.8x8.com/api/█/IDCross-site Scripting (XSS) - Stored · high
    $1,337108 votes
  3. connect.8x8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users/<User ID>/invitesImproper Access Control - Generic · high
    105 votes
  4. Information Disclosure of metrics fax.wavecell.com/metricsInformation Disclosure · low
    93 votes
  5. █.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid ServicesInformation Disclosure · medium
    $50088 votes
  6. jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofingImproper Input Validation · low
    $10072 votes
  7. jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`Path Traversal · low
    $10068 votes
  8. connect.8x8.com: Blind SSRF via /api/v2/chats/image-check allows for Internal Ports scanServer-Side Request Forgery (SSRF) · medium
    65 votes
  9. JaaS SIP Gateway Authorization BypassMissing Authorization · medium
    $50064 votes
  10. Jitsi Desktop Client RCE By Interacting with Malicious URL Schemes on WindowsOS Command Injection · high
    $77751 votes
  11. connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)Deserialization of Untrusted Data · critical
    $3,00049 votes
  12. Unprotected Atlantis Server at https://152.70.█.█Improper Authentication - Generic · medium
    48 votes
  13. admin.8x8.vc: Member users with no permission can integrate email to connect calendar via GET /meet-external/spot-roomkeeper/v1/calendar/auth/init?..Improper Access Control - Generic · high
    48 votes
  14. Credential leak on GitHub: https://github.com/█/█/ (Peoplesoft CRM)Use of Hard-coded Credentials · low
    47 votes
  15. Open Redirect via Non-Latin Subdomain in vcc-*.8x8.com/AGUI/█.phpOpen Redirect · low
    $10046 votes
  16. F5 BIG-IP TMUI RCE - CVE-2020-5902 (██.packet8.net)Code Injection · critical
    46 votes
  17. Reflected xss on 8x8.com subdomainCross-site Scripting (XSS) - Reflected · medium
    44 votes
  18. Blind Command Injection #1Command Injection - Generic · high
    42 votes
  19. wavecell.com: Broken Link Hijacking / Instagram Takeover @██Externally Controlled Reference to a Resource in Another Sphere · low
    41 votes
  20. Subdomain takeover of ███.wavecell.comPrivilege Escalation · high
    39 votes
  21. [jitsi-meet] Authentication Bypass when using JWT w/ public keysImproper Authentication - Generic · medium
    37 votes
  22. connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step OutputsExternal Control of Critical State Data · high
    $1,33736 votes
  23. Remote Code Execution on ██.8x8.com via .NET VSTATE DeserializationCode Injection · critical
    36 votes
  24. connect.8x8.com: Users with no permission can track/access restricted details/data via GET /api/v2/support/requests/<ticket number >HTTP/2Information Disclosure · high
    31 votes
  25. Open Redirect - Polycom Company DirectoryOpen Redirect · low
    28 votes
  26. Default credentials lead to Spring Boot Admin dashboard accessInformation Disclosure · medium
    28 votes
  27. @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)Cross-site Scripting (XSS) - Generic · low
    25 votes
  28. jaas.8x8.vc: Removed users can still have READ/WRITE access to the workspace via different API endpointsImproper Access Control - Generic · high
    25 votes
  29. CVE-2019-11248 on http://█.█.█.█:9100/debug/pprof/goroutineInformation Disclosure · low
    24 votes
  30. connect.8x8.com: deactivated users remain access to /api/v1/users/UUID/rolesImproper Access Control - Generic · high
    24 votes
  31. ████ api key exposed in github.com/███/███Cleartext Storage of Sensitive Information · high
    23 votes
  32. Open TURN relay abuse is possible due to lack of peer access control (Critical)Server-Side Request Forgery (SSRF) · high
    $70023 votes
  33. Exposed kubernetes dashboardInformation Disclosure · medium
    22 votes
  34. Access to ██████████████ due to weak credentialsImproper Authentication - Generic · medium
    22 votes
  35. Stored Cross Site Scripting.Cross-site Scripting (XSS) - Stored · high
    20 votes
  36. LFI via Jolokia at https://█.█.█.█:1293Information Disclosure · medium
    19 votes
  37. Admin Reseller Account DisclosureInformation Disclosure · critical
    19 votes
  38. Directory Listing at https://█.█.█.█File and Directory Information Exposure · low
    18 votes
  39. Authentication Bypass & ApacheTomcat Misconfiguration in [██]Improper Authentication - Generic · medium
    18 votes
  40. DNS Misconfiguration (Subdomain Takeover) - █████████.8x8.comPrivilege Escalation · medium
    18 votes
  41. Insecure OAuth redirection at [admin.8x8.vc]Improper Input Validation · high
    18 votes
  42. Jitsi: Bridge Message Spoofing due to Improper JSON Handling leads to Prototype PollutionCommand Injection - Generic · medium
    17 votes
  43. Public Apache Tomcat /examples example directoryInformation Exposure Through Directory Listing · medium
    17 votes
  44. Hardcoded credentials in Android AppInformation Disclosure · high
    17 votes
  45. Reflected xss on 8x8.vcCross-site Scripting (XSS) - Reflected · medium
    16 votes
  46. speedtest.8x8.com: Enabled Directory Listing Information Exposure Through Directory Listing · low
    15 votes
  47. Open Redirect ███.8x8.comOpen Redirect · low
    15 votes
  48. DNS Misconfiguration (Subdomain Takeover) ███.wavecell.comPrivilege Escalation · high
    15 votes
  49. 2FA Disable With Wrong Password - Response Tampering.Improper Input Validation · high
    14 votes
  50. Directory Listing vulnerability on █.packet8.net/php/include/Information Exposure Through Directory Listing · low
    14 votes
  51. Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · low
    13 votes
  52. (Critical) Remote Code Execution Through Old TinyMCE upload bypassCode Injection · high
    13 votes
  53. connect.8x8.com: Too much resource consumption of the server due to incorrect date range control via /api/v1/reports?dateFrom=Violation of Secure Design Principles · low
    12 votes
  54. Subdomain takeover of ████.jitsi.netPrivilege Escalation · high
    12 votes
  55. vidyard api auth_token exposedInformation Disclosure · medium
    12 votes
  56. CRLF injection agentcrm.8x8.comCRLF Injection · medium
    12 votes
  57. Unprotected Atlantis Server at https://152.70.█.█Improper Authentication - Generic · medium
    11 votes
  58. DNS Misconfiguration (Subdomain Takeover) █.staging.█.8x8.comPrivilege Escalation · high
    11 votes
  59. Exposed PHP dependencies at ██.8x8.comInformation Disclosure · low
    10 votes
  60. DNS Misconfiguration (Subdomain Takeover) ███████.8x8.comPrivilege Escalation · high
    10 votes
  61. Directory listing of https://get8x8.com/low
    10 votes
  62. Cross-site Scripting (XSS) - ReflectedCross-site Scripting (XSS) - Reflected · high
    10 votes
  63. subdomain takeover (abandoned Zendesk █.easycontactnow.com)Misconfiguration · medium
    9 votes
  64. Dangling DNS Record docs.jitsi.net (unsuccessful GSuite takeover)Violation of Secure Design Principles · low
    9 votes
  65. DOM Based XSS at docs.8x8.comCross-site Scripting (XSS) - DOM · medium
    9 votes
  66. Outdated Coturn is vulnerable to known vulnerabilities (High)Improper Authentication - Generic · high
    9 votes
  67. Send Phishing/Spam email from [email protected] to any email address.Improper Input Validation · high
    9 votes
  68. Disclosure of Users Information On Wordpress Api [https://jitsi.org/]Improper Access Control - Generic · low
    9 votes
  69. Xss (cross site scripting) on http://axa.dxi.eu/Cross-site Scripting (XSS) - Reflected · medium
    9 votes
  70. Open Redirect on https://██.8x8.com/login?nextPage=%2FOpen Redirect · low
    8 votes
  71. [CRITICAL] Remote code execution on http://axa.dxi.euCode Injection · critical
    8 votes
  72. Post based XSS (Cross site scripting) on https://apimgr.8x8.comCross-site Scripting (XSS) - Generic · medium
    8 votes
  73. Hardcoded AWS credentials in ███████.msiUse of Hard-coded Credentials · critical
    7 votes
  74. Default Creds Spring Boot AdminInformation Disclosure · high
    7 votes
  75. IDOR: Adding Contacts to Other User GroupsInsecure Direct Object Reference (IDOR) · low
    7 votes
  76. xmlrpc.php file enabledServer-Side Request Forgery (SSRF) · medium
    7 votes
  77. 8x8pilot.com: Reflected XSS in Apache Tomcat /jsp-examples example directoryCross-site Scripting (XSS) - Reflected · medium
    6 votes
  78. PHPinfo page on http://█████.callstats.ioInformation Disclosure · low
    6 votes
  79. [CRITICAL] Sql Injection on http://axa.dxi.euSQL Injection · critical
    6 votes
  80. Publicly accessible .svn repository - aastraconf.packet8.netInformation Disclosure · medium
    6 votes
  81. Subdomain Takeover at http://██.get8x8.com/Leftover Debug Code (Backdoor) · medium
    5 votes
  82. DLL Search-Order Hijacking Vulnerability in work-64-exe-v7.16.3-1.exePrivilege Escalation · low
    5 votes
  83. Stored XSS on Company LogoCleartext Storage of Sensitive Information · medium
    5 votes
  84. Stored XSS agent_status Cross-site Scripting (XSS) - Stored · high
    4 votes
  85. Bypass Email activation on http://axa.dxi.euImproper Access Control - Generic · high
    4 votes
  86. XSS (Cross site scripting) on https://apimgr.8x8.comCross-site Scripting (XSS) - Reflected · medium
    4 votes
  87. SQL injection (stacked queries) in the export to Excel functionality on Vidyo ServerSQL Injection · high
    3 votes
  88. Reflected XSS on http://axa.dxi.euCross-site Scripting (XSS) - Reflected · medium
    3 votes
  89. Sensitive information disclosureInformation Disclosure · medium
    2 votes
  90. Open Redirect on [blog.wavecell.com]Open Redirect · low
    1 votes
  91. Sensitive data disclosure via exposed phpunit fileInformation Disclosure · high
    1 votes