CVE-2024-5933

A Cross-site Scripting XSS vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest version. This vulnerability allows an attacker to inject malicious scripts via chat messages, which are then executed in the context of the user's browser...

PT-2024-37248 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version latest Description: A Cross-site Scripting XSS issue exists in the chat functionality, allowing an attacker to inject malicious scripts via chat messages. These scripts are then executed in the context of the...

CVE-2024-28593

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

PT-2024-15559 · Git +2 · Anything-Llm +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows a user to send a chat containing an XSS opportunity, which will execute when the chat is sent and on subsequent page loads. The risk is...

PT-2023-24250 · Verint · Verint Engagement Management

Name of the Vulnerable Software and Affected Versions: Verint Engagement Management version 15.3 Update 2023R2 Description: The issue concerns HTML injection via the user data form in the live chat. This allows for potential malicious code injection. Recommendations: For Verint Engagement...

CVE-2023-26040 Discourse chat messages susceptible to Cross-site Scripting through chat excerpts

Discourse is an open-source discussion platform. Between versions 3.1.0.beta2 and 3.1.0.beta3 of the tests-passed branch, editing or responding to a chat message containing malicious content could lead to a cross-site scripting attack. This issue is patched in version 3.1.0.beta3 of the...

SUSE CVE-2022-39835

An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...

CVE-2022-47416 LogicalDOC Chat Stored XSS

LogicalDOC Enterprise is vulnerable to a stored persistent, or "Type II" cross-site scripting XSS condition in the in-app chat system...

CVE-2022-4480 Click to Chat < 3.18.1 - Contributor+ Stored XSS

The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privile...

UBUNTU-CVE-2022-39835

An issue was discovered in Gajim through 1.4.7. The vulnerability allows attackers, via crafted XML stanzas, to correct messages that were not sent by them. The attacker needs to be part of the group chat or single chat. The fixed version is 1.5.0...

CVE-2022-31064 Cross site scripting in username that will trigger by sending chat

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker with xss in the name starts a chat. in the victim's client the JavaScript will be executed...

CVE-2021-27773

This vulnerability allows users to execute a clickjacking attack in the meeting's chat...

CVE-2021-43633

Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat, the script will be executed on the receiver chat...

CVE-2021-44208

OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat...

Security update for MozillaThunderbird (important)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2022:0058-1 Rating: important References: 1144018 1181400 1194020 1194215 1194681 Cross-References: CVE-2020-15803 CVE-2021-27927 CVE-2021-4126 CVE-2021-44538 CVE-2022-23134 CVSS scores: CVE-2020-15803 N...

CVE-2022-22780

The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availabili...

Design/Logic Flaw

The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availabili...

Zoom Client 资源管理错误漏洞

ZOOM Client is a video conferencing client application from ZOOM USA that supports multiple platforms. A security vulnerability exists in Zoom Client for Meetings that stems from the vulnerability of the Zoom Client for Meetings chat feature to a Zip Bomb attack. This could cause availability...

PYSEC-2022-43

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions anyone with access to the chat environment can write messages disguised as another chat participant...

UBUNTU-CVE-2022-21695

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users or unauthenticated in public mode can send messages without being visible in the list of chat participants. Th...