Denial Of Service (DoS)

pocketmine/pocketmine-mp is vulnerable to denial of service. The vulnerability exists in the chat function of Player.php due to the lack of message length checks, allowing an attacker to crash the application by providing large messages with many newlines...

Denial-of-service vulnerability processing large chat messages containing many newlines

Impact PocketMine-MP caps maximum chat message length at 512 Unicode characters, or about 2048 bytes. No more than 2 chat messages may be sent per tick. However, due to legacy reasons, incoming chat message blobs are split by \n, and each part is treated as a separate message, the length of each...

New Zoom Flaws Could Let Attackers Hack Victims Just by Sending them a Message

Popular video conferencing service Zoom has resolved as many as four security vulnerabilities, which could be exploited to compromise another user over chat by sending specially crafted Extensible Messaging and Presence Protocol XMPP messages and execute malicious code. Tracked from CVE-2022-2278...

GHSA-W47G-4VRC-M3W2 Cross-site Scripting in Apache Pluto Chatroom demo

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting XSS attacks. Mitigation: Uninstall the ChatRoomDemo war file - or - migrate to version 3.1.0 of the chat-room-demo war file...

Cisco Enterprise Chat and Email跨站脚本漏洞（CNVD-2022-50667）

Cisco Enterprise Chat and Email is a set of enterprise chat and email solutions from Cisco USA. Cisco Enterprise Chat and Email is a cross-site scripting vulnerability that could be exploited by attackers to execute arbitrary code in the context of the interface or access sensitive browser-based...

CVE-2022-20802

A vulnerability in the web interface of Cisco Enterprise Chat and Email ECE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by...

Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability

A vulnerability in the web interface of Cisco Enterprise Chat and Email ECE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed by...

Cisco Enterprise Chat and Email 跨站脚本漏洞

Cisco Enterprise Chat and Email is a set of enterprise chat and email solutions from Cisco USA. Cisco Enterprise Chat and Email is a cross-site scripting vulnerability that could be exploited by attackers to execute arbitrary code in the context of the interface or access sensitive browser-based...

CVE-2021-27773

This vulnerability allows users to execute a clickjacking attack in the meeting's chat...

CVE-2021-27773

This vulnerability allows users to execute a clickjacking attack in the meeting's chat...

CVE-2021-27771

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID SID. This value is also used when sending chat messages,...

CVE-2021-27771

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID SID. This value is also used when sending chat messages,...

Design/Logic Flaw

This vulnerability allows users to execute a clickjacking attack in the meeting's chat...

CVE-2021-27773

CVE-2021-27773 affects HCL Sametime, specifically version 11.6, where the issue enables clickjacking within the meeting chat. The vulnerability is documented with a CVSSv3.1 base score of 4.3 (Medium) and CVSSv2 base score 4.3, indicating network-based exposure with no privileges and user interac...

CVE-2021-27773 HCL Sametime is vulnerable to clickjacking

This vulnerability allows users to execute a clickjacking attack in the meeting's chat...

CVE-2021-27771

CVE-2021-27771 affects HCL Sametime (version 11.6 per CNVD) where an attacker can modify the user SID stored in cookies to trigger arbitrary file upload or deletion of directories, leading to a Denial of Service. The vulnerability arises from SID handling within the Sametime chat/file transfer fl...

WordPress JivoChat Live Chat plugin <= 1.3.5.3 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by Muhamad Hidayat in WordPress JivoChat Live Chat plugin versions = 1.3.5.3. Solution Update the WordPress JivoChat Live Chat plugin to the latest available version at least 1.3.5.4...

CVE-2021-27760

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code...

Remote code execution

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code...

CVE-2021-27760

The CVE-2021-27760 entry concerns HCL Notes 11.0–11.0.1 FP4 Sametime Embedded chat clients, where an authenticated Sametime chat user can trigger Remote Code Execution on another chat client by sending a specially formatted message containing Javascript code. The vulnerability arises in group cha...