CVE-2015-8601: Exposure of Sensitive Information to an Unauthorized Actor

The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors...

PT-2015-7815

Name of the Vulnerable Software and Affected Versions Drupal Chat Room module versions 7.x-2.x before 7.x-2.2 Description The issue allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms. This is due to the module not properly checking permissio...

Shopify: [livechat.shopify.com] Cookie bomb at customer chats

When we visit the https://livechat.shopify.com/customer/chats/new page the ref and ssid URL parameters are used to set cookie values the way as follows: var getURLParameter = functionname return decodeURIComponentnew RegExp'?|&' + name + '=' + '^&;+?&||;|$'.execlocation.search||,""1.replace/+/g,...

Tor Messenger - Chat over Tor, Easily

Tor Messenger is a cross-platform chat program that aims to be secure by default and sends all of its traffic over Tor. It supports a wide variety of transport networks, including Jabber XMPP , IRC , Google Talk , Facebook Chat , Twitter , Yahoo , and others; enables Off-the-Record OTR Messaging...

chat.sniglets.com XSS vulnerability

Vulnerable URL: https://chat.sniglets.com:9091/webchat/email/offline-mail.jsp?workgroup=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Chat Room - Moderately Critical - Access Bypass - SA-CONTRIB-2015-169

Chat Room enables site owners to integrate chats into nodes by adding the chat room field to them. The module relies on a websocket connection to send chat messages to the client. The module doesn't sufficiently validate access before setting up the websocket. As a result, users may receive...

Frame high-speed chat vulnerable to cross-site scripting

Overview Frame high-speed chat provided by Let's PHP! contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Apply an Update Update to the latest version according to the information provided by the developer...

JVN#35845584: Frame high-speed chat vulnerable to cross-site scripting

Frame high-speed chat provided by Let's PHP! contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Apply an Update Update to the latest version according to the information provided by the developer. Products Affected...

Tor Messenger

Tor Project launched its first beta version of Tor Messenger – its long-in-the-works, open source instant messenger client based on Instantbird. The Messenger is designed for both simplicity and privacy by default: It integrates the “Off-the-Record” OTR protocol to encrypt messages and routes the...

How to Auto-BackUp Your WhatsApp Data to Google Drive with Encryption

What if your phone suddenly slips into a bathtub? Maybe you'll end up losing all your important data, more specifically, your WhatsApp photos, videos, Voice Notes and Chat Data that flows through your chats. Sounds scary, isn't it? But, now you need not worry if your phone suddenly died or broke ...

Zendesk: CSV Excel Macro Injection Vulnerability in export chat logs

Scenario: An attacker creates a name as =AND21 with a fake email and with random text in the message body. This is similar to a vulnerability recently found in zendesk.com as well. When a team member clicks export as csv and opens it instead of seeing =AND21 they see TRUE. Meaning that cell is no...

Firefox 41 integrates Free Built-in Instant Messaging and Video Chat to Your Browser

Mozilla launches Voice and Video Connect with the release of Official Firefox 41.0 Release. After significant improvements done in the Firefox Nightly experimental build of version Firefox 41.0, the stable release has a lot to offer. How would it be experiencing a seamless communication – video a...

[SECURITY] Fedora 23 Update: smuxi-1.0-2.fc23

Smuxi is an open-source, powerful, flexible, and user-friendly chat client created by Mirco Bauer and developed by other contributors. Inspired by the combination of screen and irssi, Smuxi has a detachable ser ver or like a "normal" client that stays connected when you aren't, and can allow...

Openfire 3.10.2 - Multiple Cross-Site Scripting Vulnerabilities

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-XSS.txt Vendor: ================================ www.igniterealtime.org/projects/openfire www.igniterealtime.org/downloads/index.jsp Product: ================================...

Openfire 3.10.2 - Multiple Cross-Site Scripting Vulnerabilities

Openfire 3.10.2 - Multiple Cross-Site Scripting Vulnerabilities + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-XSS.txt Vendor: ================================ www.igniterealtime.org/projects/openfire...

Cisco Unified Web and E-mail Interaction Manager Cross-Site Scripting Vulnerability

Cisco Unified Web and E-mail Interaction Manager are both products in Cisco's Customer Collaboration Contact Center.Web Interaction Manager is a product that helps call center agents answer customer questions using websites and text chat or real-time Web collaboration; E-mail Interaction Manager ...

CVE-2015-6255

Cross-site scripting XSS vulnerability in Cisco Unified Web and E-Mail Interaction Manager 9.02 allows remote attackers to inject arbitrary web script or HTML via a crafted chat message, aka Bug ID CSCuo89051...

WordPress WP Symposium Plugin 15.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin wp-symposium Unauthenticated SQL Injection Vulnerability Date: 2015-07-30 Exploit Author: PizzaHatHacker Vendor Homepage: http://www.wpsymposium.com/ Version: ? = version = 15.5.1 Tested on: Apache / WordPress...

PT-2015-7141

Name of the Vulnerable Software and Affected Versions Cisco Unified Web and E-Mail Interaction Manager version 9.02 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted chat message. Recommendations For Cisco Unified Web and...

CVE-2015-6255: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Cisco Unified Web and E-Mail Interaction Manager 9.02 allows remote attackers to inject arbitrary web script or HTML via a crafted chat message, aka Bug ID CSCuo89051...