HexBrain
Sign in

Browse / Zendesk

Zendesk

46disclosed reports

See its reports on the map

What gets reported to Zendesk

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Twitter SSO allows unverified e-mail registration, leads to Slack and social media hijacksImproper Authentication - Generic
    70 votes
  2. Privilege escalation - Support-Contributor to Support and Product Admin via `/api/v2/██████` . No ADMIN PRIVILEGE required.Privilege Escalation
    58 votes
  3. Blind XSS via Suspended Ticket RecoveryCross-site Scripting (XSS) - Reflected
    47 votes
  4. Remote code execution as root on [REDACTED]Code Injection
    35 votes
  5. Stored Cross Site Scripting on Zendesk agent dashboardCross-site Scripting (XSS) - Stored
    28 votes
  6. Stored XSS in Macro Editing - Introduced by Admins to affect AdminsCross-site Scripting (XSS) - Stored
    27 votes
  7. Leaked artifactory_api_key via GitHub.Information Disclosure
    24 votes
  8. Leaked artifactory_key, artifactory_api_key, and gcloud refresh_token via GitHub.Improper Authentication - Generic
    22 votes
  9. SMTP user enumeration via mail.zendesk.comInformation Disclosure
    21 votes
  10. XSS in zendesk.com/product/Cross-site Scripting (XSS) - Generic
    21 votes
  11. Admin Macro Description Stored XSSCross-site Scripting (XSS) - Stored
    19 votes
  12. CSRF on developer.zendesk.com via Cache DeceptionCross-Site Request Forgery (CSRF)
    15 votes
  13. SSRF issue in "URL target" allows [REDACTED]Information Disclosure
    14 votes
  14. open redirect in <your_zendesk>.zendesk.comOpen Redirect
    13 votes
  15. "Test target" of the "HTTP target" extension can unintentionally send username and password in the Authorization headerCleartext Transmission of Sensitive Information
    12 votes
  16. Secret API Key Leakage via Query StringInformation Disclosure
    12 votes
  17. AWS S3 bucket writable for authenticated aws userImproper Authentication - Generic
    12 votes
  18. Race Condition in Article "Helpful" IndicatorBusiness Logic Errors
    12 votes
  19. XSS with needed user interventionCross-site Scripting (XSS) - Generic
    11 votes
  20. dom based xss in *.zendesk.com/external/zenbox/Cross-site Scripting (XSS) - DOM
    9 votes
  21. Stored XSS via Angular Expression injection on developer.zendesk.comCross-site Scripting (XSS) - Generic
    9 votes
  22. Stored XSS in Draft Articles. Cross-site Scripting (XSS) - Generic
    9 votes
  23. a stored xss in web widget chatCross-site Scripting (XSS) - Generic
    8 votes
  24. Error stack trace enabledInformation Disclosure
    8 votes
  25. [CRITICAL] CSRF leading to account take overCross-Site Request Forgery (CSRF)
    7 votes
  26. express config leaking stacktraceInformation Disclosure
    6 votes
  27. CSV Excel Macro Injection Vulnerability in export chat logsCommand Injection - Generic
    6 votes
  28. CSV Excel Macro Injection Vulnerability in export customer ticketsCommand Injection - Generic
    6 votes
  29. Unvalidated / Open RedirectOpen Redirect
    5 votes
  30. Android SDK - CREATE_REQUEST broascast is unprotectedInformation Disclosure
    5 votes
  31. [status.zopim.com] Open RedirectOpen Redirect
    5 votes
  32. Stored XSS in commentsCross-site Scripting (XSS) - Generic
    5 votes
  33. Full Sub Domain Takeover at wx.zopim.net
    4 votes
  34. Stored XSS on [your_zendesk].zendesk.com in Facebook ChannelCross-site Scripting (XSS) - Generic
    4 votes
  35. [CRITICAL] HTML injection issue leading to account take overCross-site Scripting (XSS) - Generic
    3 votes
  36. Stored XSS in commentsCross-site Scripting (XSS) - Generic
    3 votes
  37. Cross-site Scripting in all ZopimCross-site Scripting (XSS) - Generic
    3 votes
  38. Cross-site Scripting https://www.zendesk.com/product/pricing/Cross-site Scripting (XSS) - Generic
    3 votes
  39. Security Missconfiguration in Autologin Cryptographic Issues - Generic
    3 votes
  40. Missing function level access controls allowing attacker to abuse file access controls. Multiple vulnerabilitiesPrivilege Escalation
    2 votes
  41. [HIGH RISK] CSRF could potentially delete a zendesk subdomain.Cross-Site Request Forgery (CSRF)
    2 votes
  42. Content Spoofing Information Disclosure
    2 votes
  43. Stored Cross site scripting In developer.zendesk.comCross-site Scripting (XSS) - Generic
    2 votes
  44. XSS In /zuora/ functionalityCross-site Scripting (XSS) - Generic
    1 votes
  45. Chat History CSV Export Excel Injection VulnerabilityCommand Injection - Generic
    1 votes
  46. [API ISSUE] agents can Create agents even after they are disabled ! Privilege Escalation
    1 votes