CVE-2020-15914

A cross-site scripting XSS vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allow a remote attacker to execute arbitrary Javascript in a target user’s Origin client. An attacker could use this vulnerability to access sensitive data related to the target user’...

Shopify: Customer's full name disclosure via Shopify Chat (by email lookup)

By making use of the Shopify Chat Application, it is possible to retrieve a customer First Name and Last Name by providing its email. Steps to reproduce 1. Having a shop with Shopify Chat installed, open up https://shop.myshopify.com/?chat in Incognito mode 1. Click on I need an update on my orde...

Shopify: Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation

It came to my attention that the Shopify Chat application allows a customer to retrieve its order status by only providing the order email and number. Noticing that it results in being provided the order status page link, I started playing a bit with both parameters and I found out that it is...

chat.symphosius.de Cross Site Scripting vulnerability OBB-1434436

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-27601

BigBlueButton before 2.2.7: the setting lockSettingsProps.disablePrivateChat is not applied to chats that are already open. Root cause is in bigbluebutton-html5/imports/ui/components/chat/service.js. Impact is that private-chat restrictions may not be enforced for existing chats (low severity per...

PT-2020-16711 · Bigbluebutton · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions prior to 2.2.7 Description: The issue arises from the lockSettingsProps.disablePrivateChat setting not being applied to chats that are already open. This problem is located in the...

Unspecified Vulnerability in Telegram Desktop (CNVD-2021-38323)

Telegram is an instant messaging mobile application.Telegram Desktop is the desktop version of Telegram. A security vulnerability exists in Telegram Desktop version 2.4.3 and earlier, which stems from a password not being required to be entered when the export key is pressed in the Export Telegra...

OTRS Information Disclosure Vulnerability (CNVD-2020-63947)

OTRS ITSM is a suite of foundational solutions for IT service management organizations from the German OTRS Group. The solution is based on ITIL best practices and provides management tools for request and fault management, problem management, change management and release management. A security...

CS Money: Blind XSS on image upload

Summary: - The CSRF vulnerability make a request for support.cs.money/uploadfile; This uploadfile does not have csrf token/ origin/ reference verification! - The XSS allows to execute JS. The payload of the XSS stay in the param 'filename' of the CSRF request. Steps To Reproduce: XSS - use a prox...

chat-sex-cams.com Cross Site Scripting vulnerability OBB-1414011

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

PT-2020-20836 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 13.6 iPadOS versions prior to 13.6 macOS Catalina versions prior to 10.15.6 tvOS versions prior to 13.4.8 watchOS versions prior to 6.2.8 Description: An issue existed in the handling of iMessage tapbacks, which was...

CVE-2020-1777

Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS; 7.0.21 and prior versions, 8.0.6 and prior versions...

CVE-2020-1777

Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS; 7.0.21 and prior versions, 8.0.6 and prior versions...

Design/Logic Flaw

Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS; 7.0.21 and prior versions, 8.0.6 and prior versions...

CVE-2020-1777

Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS; 7.0.21 and prior versions, 8.0.6 and prior versions...

CVE-2020-1777 Agent names disclosed in chat feature

Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS; 7.0.21 and prior versions, 8.0.6 and prior versions...

CVE-2020-1777

CVE-2020-1777 affects OTRS: agent names reveal in chat interfaces and ticket transcripts when masking real agent names is configured. Affected versions: OTRS 7.0.21 and earlier, 8.0.6 and earlier. CVSS metrics indicate a MEDIUM severity: CVSS v3.1 base score 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A...

CVE-2020-5642

Cross-site request forgery CSRF vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2020-5642

Cross-site request forgery CSRF vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...