CVE-2022-0253

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Discourse has an unspecified vulnerability (CNVD-2022-05505)

Discourse is an open source community discussion platform that includes community, email, and chat room features. A security vulnerability exists in Discourse, which stems from the fact that users invited via email to a forum with "must approve users" enabled will automatically log in, bypassing...

Discourse Information Disclosure Vulnerability (CNVD-2022-05504)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.Discourse is vulnerable to an information disclosure vulnerability that could be exploited by attackers to obtain private configuration files...

CVE-2022-0226

livehelperchat is vulnerable to Cross-Site Request Forgery CSRF...

CVE-2022-0231

livehelperchat is vulnerable to Cross-Site Request Forgery CSRF...

Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

Description A CSRF issue is found in the SettingsLive help configurationCanned Messages. It was found that no CSRF token validation is getting done as no CSRF token is getting passed with the request. Also while generating statistics, the action is done through GET method with no CSRF token. Two...

livehelperchat 跨站请求伪造漏洞

livehelperchat is available through live helper chat and can be used to provide live support on the website for free. A cross-site request forgery vulnerability exists in livehelperchat, which stems from a WEB application that does not adequately validate that a request is coming from a trusted...

Cisco Enterprise Chat and Email Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email ECE could allow an unauthenticated, remote attacker to perform cross-site scripting XSS attacks, enumerate existing user accounts, and redirect a user to an undesired webpage. For more information...

Cisco Enterprise Chat and Email 安全漏洞

Cisco Enterprise Chat and Email CEC is a suite of enterprise chat and email solutions from Cisco. The product provides email, chat, and Web callback capabilities for other Cisco solutions. A security vulnerability exists in Cisco Enterprise Chat and Email that stems from the web-based management...

Cisco Enterprise Chat and Email 安全漏洞

Cisco Enterprise Chat and Email CEC is a suite of enterprise chat and email solutions from Cisco. The product provides e-mail, chat, and Web callback capabilities for other Cisco solutions. A security vulnerability exists in Cisco Enterprise Chat and Email that stems from a vulnerability in the...

PT-2022-1430 · Cisco · Cisco Ece

Name of the Vulnerable Software and Affected Versions: Cisco ECE affected versions not specified Description: A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the...

Cisco Enterprise Chat and Email 跨站脚本漏洞

Cisco Enterprise Chat and Email CEC is a suite of enterprise chat and email solutions from Cisco. The product provides email, chat, and web callback functionality for other Cisco solutions. A cross-site scripting vulnerability exists in Cisco Enterprise Chat and Email, which originates from the...

Cisco Enterprise Chat and Email 输入验证错误漏洞

Cisco Enterprise Chat and Email CEC is a suite of enterprise chat and email solutions from Cisco. The product provides email, chat, and web callback functionality for other Cisco solutions. Cisco Enterprise Chat and Email suffers from an input validation error vulnerability that stems from a...

Discourse Information Disclosure Vulnerability (CNVD-2022-05506)

Discourse is an open source community discussion platform. The platform includes community, email and chat room features.Discourse suffers from an information disclosure vulnerability for which no detailed vulnerability details are currently available...

livehelperchat Information Disclosure Vulnerability

livehelperchat is available through live helper chat and can be used to provide live support on the website for free. An information disclosure vulnerability exists in livehelperchat that stems from the inclusion of sensitive information when generating error messages. An attacker may exploit thi...

Cross site scripting

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

Design/Logic Flaw

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

CVE-2022-21649 Stored XSS via attribute in convos

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

CVE-2022-21649

Convos (open source multi-user web chat) is affected by a Stored XSS in chat messages. The vulnerability arises because escaping exists for but not for double quotes, enabling attacker-controlled scripts via the chat window (e.g., injected by https:// links that become tags). The root cause is ...

CVE-2022-21649 Stored XSS via attribute in convos

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...