PT-2024-29378 · Organizr · Organizr

Name of the Vulnerable Software and Affected Versions: Organizr version 1.90 Description: The issue is a SQL injection problem. It occurs via the chat/setlike.php file. Recommendations: For Organizr version 1.90, consider restricting access to the chat/setlike.php file until a patch is available...

Organizr 安全漏洞

Organizr is a tab management system for causefx individual developers. It is intended to be a one-stop store on the front end of the server. A security vulnerability exists in Organizr v1.90, which stems from a SQL injection vulnerability via chat/setlike.php...

Organizr 安全漏洞

Organizr is a tab management system for causefx individual developers. It is intended to be a one-stop store on the front end of the server. A security vulnerability exists in Organizr v1.90, which stems from a SQL injection vulnerability via chat/settyping.php...

CVE-2024-41372

Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php...

CVE-2024-41370

Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php...

CVE-2024-41370

Organizr v1.90 contains a SQL injection vulnerability in chat/setlike.php. Root cause: improper handling of input leading to SQL injection. Impact per sources: high confidentiality, integrity, and availability risk (CVSS v3.1 base score 9.8). No patch/version containing a fix is documented in the...

WordPress Gixaw Chat plugin <= 1.0 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin Gixaw Chat versions = 1.0...

WordPress Gixaw Chat Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Gixaw Chat Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7816 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID aa72a581011b Credits Daniel Ruf Required privilege...

GO-2022-0291 Unsafe inline XSS in pasting DOM element into chat in github.com/owncast/owncast

Unsafe inline XSS in pasting DOM element into chat in github.com/owncast/owncast...

Spring AI with NVIDIA LLM API

Spring AI now supports NVIDIA's Large Language Model API, offering integration with a wide range of models. By leveraging NVIDIA's OpenAI-compatible API, Spring AI allows developers to use NVIDIA's LLMs through the familiar Spring AI API. We'll explore how to configure and use the Spring AI OpenA...

Spring AI Embraces OpenAI's Structured Outputs: Enhancing JSON Response Reliability

OpenAI recently introduced a powerful feature called Structured Outputs, which ensures that AI-generated responses adhere strictly to a predefined JSON schema. This feature significantly improves the reliability and usability of AI-generated content in real-world applications. Today, we're excite...

CVE-2024-42347

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the...

CVE-2024-42347

Affects matrix-react-sdk (Matrix web client component). A malicious homeserver could manipulate a user’s account data to enable URL previews in end-to-end encrypted rooms, causing URLs from encrypted messages to be sent to the server. This is mitigated by upgrading to matrix-react-sdk version 3.1...

CVE-2024-42347 URL preview setting for a room is controllable by the homeserver in matrix-react-sdk

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the...

PT-2024-28648

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 6.10.1 Description A Server-Side Request Forgery SSRF issue affects Rocket.Chat's Twilio webhook endpoint. This allows attackers to redirect requests, potentially risking sensitive data. Approximately 1781 IPs hav...

CVE-2024-7204

Ai3 QbiBot does not properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. Once the recipient views the message, they will be subject to a Stored XSS attack...

CVE-2024-7204

Ai3 QbiBot does not properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. Once the recipient views the message, they will be subject to a Stored XSS attack...

CVE-2024-7204 Ai3 QbiBot - Stored XSS

Ai3 QbiBot does not properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. Once the recipient views the message, they will be subject to a Stored XSS attack...

CVE-2024-7204 Ai3 QbiBot - Stored XSS

Ai3 QbiBot does not properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. Once the recipient views the message, they will be subject to a Stored XSS attack...

Ai3 QbiBot 跨站脚本漏洞

Ai3 QbiBot is an intelligent customer service from the Chinese company Ai3. Ai3 QbiBot v8.0.9.b1 and prior versions suffer from a cross-site scripting vulnerability that originates from not properly filtering user input, allowing an unauthenticated, remote attacker to insert JavaScript code into...