Rocket.Chat 安全漏洞

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat versions 3.11, 3.12, and 3.13. The vulnerability could lead to unauthenticated NoSQL injection. No details of the vulnerability are provided at this time...

PT-2021-15268 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat server versions 3.11 through 3.13 Description: A vulnerability exists due to improper input sanitization, potentially leading to unauthenticated NoSQL injection and resulting in remote code execution RCE. Recommendations: For...

WordPress iFlyChat – WordPress Chat plugin <= 4.6.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Kishore Hariram in WordPress iFlyChat – WordPress Chat plugin versions = 4.6.4. Solution Update the WordPress iFlyChat – WordPress Chat plugin to the latest available version at least 4.7.0...

CVE-2021-32632

Pajbot is a Twitch chat bot. CVE-2021-32632 covers CSRF in Pajbot versions prior to 1.52, enabling modification of commands, modules, and banphrases via hidden iframes. Affected component: the web application lacks sufficient request validation, leading to cross-site forgery. Impact is defined as...

libvncserver: libvncclient/rfbproto.c does not limit TextChat size

An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size...

Nextcloud: User deletion is not handled properly everywhere

So I came across this when going over https://nextcloud.com/compare/ And noticed the section: "BUILT IN DATA-REQUEST/ACCOUNT DELETION" However looking at this it seems this is not handled properly everywhere in Nextcloud. I understand that the GDPR etc do consider shared data differently. For...

Travis Ralston matrix-react-sdk 代码问题漏洞

Travis Ralston matrix-react-sdk is an open source application by Travis Ralston. Used to insert the Matrix chat/voice client into a web page. A code issue vulnerability exists in Matrix-React-SDK that arises from an improperly designed or implemented code development process for a web system or...

Student Management System 1.0 - (message) Persistent Cross-Site Scripting Vulnerability

Exploit Title: Student Management System 1.0 - 'message' Persistent Cross-Site Scripting Authenticated Exploit Author: mohsen khashei kh4sh3i or email protected Vendor Homepage: https://github.com/amirhamza05/Student-Management-System Software Link:...

Student Management System 1.0 Cross Site Scripting

Exploit Title: Student Management System 1.0 - 'message' Persistent Cross-Site Scripting Authenticated Date: 2021-05-13 Exploit Author: mohsen khashei kh4sh3i or [email protected] Vendor Homepage: https://github.com/amirhamza05/Student-Management-System Software Link:...

Student Management System 1.0 - 'message' Persistent Cross-Site Scripting (Authenticated)

Exploit Title: Student Management System 1.0 - 'message' Persistent Cross-Site Scripting Authenticated Date: 2021-05-13 Exploit Author: mohsen khashei kh4sh3i or [email protected] Vendor Homepage: https://github.com/amirhamza05/Student-Management-System Software Link:...

Unspecified vulnerability in Zulip server (CNVD-2021-39546)

Zulip server is an open source team chat application from the American company Zulip. A security vulnerability exists in version 3.x prior to Zulip Server 3.4, which stems from the ability of an organization administrator to move messages to streams in other organizations hosted by the same Zulip...

Zulip server access control error vulnerability

Zulip server is an open source team chat application from the American company Zulip. An access control error vulnerability exists in versions of Zulip Server prior to 3.4, which stems from a bug in the implementation of replies to messages that send a webhook to a private stream.No details of th...

How chat platforms are using Machine Learning for content moderation?

By Uzair Amir More and more online services are using Machine Learning ML, the method of data analysis that will automate the building of analytical mode. This is a post from HackRead.com Read the original post: How chat platforms are using Machine Learning for content moderation?...

CVE-2021-24246

The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscoutsendmessagechat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues...

CVE-2021-24246

The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscoutsendmessagechat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues...

Cross site scripting

The Workscout Core WordPress plugin before 1.3.4, used by the WorkScout Theme did not sanitise the chat messages sent via the workscoutsendmessagechat AJAX action, leading to Stored Cross-Site Scripting and Cross-Frame Scripting issues...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Workscout Core Plugin versions prior to...

EulerOS 2.0 SP3 : irssi (EulerOS-SA-2021-1803)

According to the version of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow...

Facebook Busts Palestinian Hackers' Operation Spreading Mobile Spyware

Facebook on Wednesday said it took steps to dismantle malicious activities perpetrated by two state-sponsored hacking groups operating out of Palestine that abused its platform to distribute malware. The social media giant attributed the attacks to a network connected to the Preventive Security...

Remote code execution

Discord-Recon is a bot for the Discord chat service. Versions of Discord-Recon 0.0.3 and prior contain a vulnerability in which a remote attacker is able to overwrite any file on the system with the command results. This can result in remote code execution when the user overwrite important files ...