ArtiBot Free Chat Bot for WordPress WebSites <= 1.1.6 - Missing Authorization to Settings Update

Description The ArtiBot Free Chat Bot for WordPress WebSites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the artibotupdate function in all versions up to, and including, 1.1.6. This makes it possible for authenticated attackers, wit...

AnythingLLM Cross-Site Scripting Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from a cross-site scripting vulnerability that originates from injecting cross-site scripting into the chat box...

CVE-2024-0435

CVE-2024-0435 describes a self-targeted cross-site scripting (XSS) flaw in a chat feature. The vulnerability allows a user to inject XSS payloads into a chat message that executes when the message is sent and on subsequent page loads. According to the sources, exploitation requires the user to ha...

CVE-2024-0435 User can submit message to self-XSS

User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for a user to send a chat is to be given access to a workspace via an admin the risk is low. Additionally, the location in which the XSS rende...

CVE-2024-0435 User can submit message to self-XSS

User can send a chat that contains an XSS opportunity that will then run when the chat is sent and on subsequent page loads. Given the minimum requirement for a user to send a chat is to be given access to a workspace via an admin the risk is low. Additionally, the location in which the XSS rende...

PT-2024-15559 · Git +2 · Anything-Llm +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows a user to send a chat containing an XSS opportunity, which will execute when the chat is sent and on subsequent page loads. The risk is...

CVE-2023-37540

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

Design/Logic Flaw

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

CVE-2023-37540

The CVE-2023-37540 entry concerns the Sametime Connect desktop chat client, which includes but does not use or require an Eclipse Secure Storage feature. The underlying issue is the use of an Eclipse feature to store sensitive data, which can lead to exposure of that data (information disclosure)...

CVE-2023-37540 HCL Sametime Chat is affected by an unimplemented feature in the UI

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

CVE-2023-37540 HCL Sametime Chat is affected by an unimplemented feature in the UI

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data...

RansomHouse am See

RansomHouse am See By Pham Duy Phuc in collaboration with Noël Keijzer and Michaël Schrijver from Northwave · February 14, 2024 This blog was also written by Max Kersten Ransom gangs make big bucks by extorting victims, which sadly isn’t new. Their lucrative business allows them not only to live...

Remote Monitoring &#038; Management software used in phishing attacks

Remote Monitoring & Management RMM software, including popular tools like AnyDesk, Atera, and Splashtop, are invaluable for IT administrators today, streamlining tasks and ensuring network integrity from afar. However, these same tools have caught the eye of cybercriminals, who exploit them to...

PT-2024-2687 · Zoom · Zoom Desktop Client For Windows +2

Name of the Vulnerable Software and Affected Versions: Zoom Desktop Client for Windows affected versions not specified Zoom VDI Client for Windows affected versions not specified Zoom Meeting SDK for Windows affected versions not specified Description: The issue is related to improper input...

PT-2024-2683 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom affected versions not specified Description: The issue is related to a business logic error in Zoom's meeting chat component, which is associated with incorrect handling of logical operations. This error may allow a remote attacker to...

HackerOne: LLM03: Training Data Poisoning via ASCII decoding

Vulnerability description not provided...

CVE-2023-51370

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4...

CVE-2023-51370

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4...

CVE-2023-51370

CVE-2023-51370 affects the WordPress WP Chat App plugin (NinjaTeam) up to version 3.4.4. The vulnerability is a Stored XSS caused by improper neutralization of user input during web page generation. PatchStack lists a fix in version 3.4.5; there are no explicit exploitation details in the provide...