Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,262
CVE-linked
1,866
Programs
343
New This Week
0
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: 8x8-bounty✕
Exposed kubernetes dashboard
8x8
Medium
2021-12-09
[jitsi-meet] Authentication Bypass when using JWT w/ public keys
8x8 Improper Authentication - Generic (CWE-287)
Medium
2021-11-20
Authentication Bypass & ApacheTomcat Misconfiguration in [██]
8x8 Improper Authentication - Generic (CWE-287)
Medium
2021-11-04
Exposed PHP dependencies at ██.8x8.com
8x8 Information Disclosure (CWE-200)CVE-2017-9841
Low
2021-10-27
DNS Misconfiguration (Subdomain Takeover) - █████████.8x8.com
8x8 Privilege Escalation (CAPEC-233)
Medium
2021-07-30
Subdomain takeover of ████.jitsi.net
8x8 Privilege Escalation (CAPEC-233)
High
2021-05-14
Subdomain takeover of ███.wavecell.com
8x8 Privilege Escalation (CAPEC-233)
High
2021-05-02
Any meeting chat history can be read and modified by an arbitrary user
8x8 Incorrect Authorization (CWE-863)
Critical
2021-04-29
DNS Misconfiguration (Subdomain Takeover) █.staging.█.8x8.com
8x8 Privilege Escalation (CAPEC-233)
High
2021-02-28
DNS Misconfiguration (Subdomain Takeover) ███.wavecell.com
8x8 Privilege Escalation (CAPEC-233)
High
2021-02-15
DNS Misconfiguration (Subdomain Takeover) ███████.8x8.com
8x8 Privilege Escalation (CAPEC-233)
High
2021-02-12
Admin Reseller Account Disclosure
8x8 Information Disclosure (CWE-200)
Critical
2020-12-15
vidyard api auth_token exposed
8x8 Information Disclosure (CWE-200)
Medium
2020-12-15
Open Redirect on [blog.wavecell.com]
8x8 Open Redirect (CWE-601)
Low
2020-10-26
2FA Disable With Wrong Password - Response Tampering.
8x8 Improper Input Validation (CWE-20)
High
2020-10-21
DOM Based XSS at docs.8x8.com
8x8 Cross-site Scripting (XSS) - DOM (CWE-79)
Medium
2020-09-22
Default Creds Spring Boot Admin
8x8 Information Disclosure (CWE-200)
High
2020-08-14
Send Phishing/Spam email from support@sameroom.io to any email address.
8x8 Improper Input Validation (CWE-20)
High
2020-08-05
SQL injection (stacked queries) in the export to Excel functionality on Vidyo Server
8x8 SQL Injection (CWE-89)
High
2020-07-29
IDOR: Adding Contacts to Other User Groups
8x8 Insecure Direct Object Reference (IDOR) (CWE-639)
Low
2020-07-27
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250—
Uber239—