CVE-2019-1668

A vulnerability in the chat feed feature of Cisco SocialMiner could allow an unauthenticated, remote attacker to perform cross-site scripting XSS attacks against a user of the web-based user interface of an affected system. This vulnerability is due to insufficient sanitization of user-supplied...

CVE-2019-1668 Cisco SocialMiner Chat Feed Cross-Site Scripting Vulnerability

A vulnerability in the chat feed feature of Cisco SocialMiner could allow an unauthenticated, remote attacker to perform cross-site scripting XSS attacks against a user of the web-based user interface of an affected system. This vulnerability is due to insufficient sanitization of user-supplied...

CVE-2019-1668

Cisco SocialMiner's Chat Feed contains XSS vulnerabilities due to insufficient sanitization of user-supplied input in chat feed HTTP requests. An unauthenticated, remote attacker could lure a user to click attacker-controlled content, enabling arbitrary script execution in the context of the affe...

Cisco SocialMiner Chat Feed Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the chat feed feature of Cisco SocialMiner could allow an unauthenticated, remote attacker to perform cross-site scripting XSS attacks against a user of the web-based user interface of an affected system. These vulnerabilities are due to insufficient sanitization of...

PT-2019-1300 · Cisco · Cisco Socialminer

Name of the Vulnerable Software and Affected Versions: Cisco SocialMiner affected versions not specified Description: A vulnerability in the chat feed feature could allow an unauthenticated, remote attacker to perform cross-site scripting XSS attacks against a user of the web-based user interface...

CVE-2018-20731

A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...

A Growing Frontier for Terrorist Groups: Unsuspecting Chat Apps

Opinion: As Twitter, Facebook, and YouTube crack down on extremist propaganda, ISIS recruiters are exploiting lesser-known messenger apps...

Chat Anywhere extension for Chrome cross-site scripting vulnerability

Chat Anywhere extension for Chrome is an online chat plugin for use in Google Chrome. A cross-site scripting vulnerability exists in the Chat Anywhere extension for Chrome version 2.4.0, which stems from the danmuWrapper DIV element in the chatbox-only\danmu.js file being out of the scope of the...

Code injection

The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy CSP...

CVE-2018-20524

The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy CSP...

CVE-2018-20524

Affected software: Chat Anywhere extension for Chrome, version 2.4.0. Vulnerability details: A cross-site scripting (XSS) flaw exists because the danmuWrapper DIV in chatbox-only\danmu.js lies outside the scope of the extension’s Content Security Policy (CSP). This can be exploited via crafted me...

Telegram Web and Telegram for Android Server-Side Request Forgery Vulnerability

Telegram for Android is an instant messaging application based on the Android platform.Telegram Web is its web version. A server-side request forgery vulnerability exists in the 'secret chat' feature in Telegram version 4.9.1 and Telegram Web version 0.7.0 for the Android-based platform. No...

CVE-2018-20436

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more...

CVE-2018-20436

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more...

Microsoft Lync For Mac 2011 Injection

Exploit Title: Microsoft Lync for Mac 2011 Injection Forced Browsing/Download Author: @nyxgeek - TrustedSec Date: 2018-03-20 Vendor Homepage: microsoft.com Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=36517 CVE: CVE-2018-8474 Version: Lync:Mac 2011 14.4.3, likely earlie...

Microsoft Lync for Mac 2011 - Injection Forced Browsing/Download

Exploit Title: Microsoft Lync for Mac 2011 Injection Forced Browsing/Download Author: @nyxgeek - TrustedSec Date: 2018-03-20 Vendor Homepage: microsoft.com Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=36517 CVE: CVE-2018-8474 Version: Lync:Mac 2011 14.4.3, likely earlie...

Starbucks: Able to bypass information requirements before launching a Chat.

Summary: Bypass of mandatory fields before a Chat session can begin. Description: URL allows for bypass straight into chat, and Chat personnel won't know my name, just that they are chatting with someone. Platforms Affected: website/mobile app - please include browsers and app versions used for...

Chaturbate: Stored XSS in chat topic due to insecure emoticon parsing on any message type

Description The funcitonality for adding emoticons into the chat from the serverside perspective is based on a string in the following format: %%%emoticon NAME|EMOTICONURL|WIDTH|HEIGHT|REPORTURL%%% The EMOTICONURL must conform to the following regex: javascript...

Simple Chat System 1.0 - 'id' SQL Injection

Exploit Title: Simple Chat System 1.0 - 'id' SQL Injection Dork: N/A Date: 2018-10-24 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/php/11610/simple-chat-system.html Software Link: https://sourceforge.net/projects/simple-chat-system/files/latest/download Version: 1....

WordPress wp-live-chat-support plugin cross-site scripting vulnerability (CNVD-2020-28776)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. wp-live-chat-support plugin is used in one of the live chat plugin . A cross-site scripting vulnerability exists ...