PT-2024-32286 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions 6.12.0 through 6.7.8 and earlier Description: The issue allows attackers to craft messages with specific characters, potentially crashing the workspace due to a problem in the message parser. This can lead to a denial of...

PT-2024-32287 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions 6.12.0 through 6.7.8 and before Description: The issue allows attackers to abuse the UpdateOTRAck method to send ephemeral messages as if they were any other user they choose, leading to a message forgery and impersonatio...

PT-2024-39457 · Flowise +1 · Flowise +1

Name of the Vulnerable Software and Affected Versions: Flowise versions prior to 2.1.1 Flowise Chat Embed versions prior to 2.0.0 Description: The issue is related to a Stored Cross-Site vulnerability due to a lack of input sanitization. Recommendations: For Flowise versions prior to 2.1.1, updat...

WordPress Instant Chat Floating Button for WordPress Websites Plugin <= 1.0.5 is vulnerable to Local File Inclusion

Software Instant Chat Floating Button for WordPress Websites Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44018 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 47df3a865e66 Credits...

lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

Summary SSRF protection implemented in https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides external malicious url which redirects to internal resources like private network or loopback address. PoC 1. Ru...

GHSA-3FC8-2R3F-8WRG lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

Summary SSRF protection implemented in https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides external malicious url which redirects to internal resources like private network or loopback address. PoC 1. Ru...

CVE-2024-47066

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...

CVE-2024-47066 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...

CVE-2024-47066

CVE-2024-47066 (Lobe Chat) is an SSRF issue in Lobe Chat prior to version 1.19.13 where server-side proxy protection in src/app/api/proxy/route.ts does not handle redirects, allowing an attacker-supplied URL to redirect to internal resources (e.g., private networks or loopback). The vulnerability...

CVE-2024-47066 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...

CVE-2024-47066 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to...

Lobe Chat 代码问题漏洞

Lobe Chat is an open source, high-performance chatbot framework open sourced from LobeHub. A code issue vulnerability exists in Lobe Chat prior to version 1.19.13, which stems from the server-side request forgery protection implemented in src/app/api/proxy/route.ts does not account for redirectio...

thunderbird: Crash when aborting verification of OTR chat

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Global Crime Hit as Europol Shuts Down Encrypted Chat App Ghost

Europol, alongside global law enforcement, dismantled the encrypted chat app Ghost, widely used by criminal networks for drug…...

thunderbird: Crash when aborting verification of OTR chat

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service. Red Hat Product Security has rated this update ...

thunderbird: Crash when aborting verification of OTR chat

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash...

thunderbird: Crash when aborting verification of OTR chat

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When aborting the verification of an OTR chat session, an attacker could have caused a use-after-free bug leading to a potentially exploitable crash...

RLSA-2024:6684 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: 115.15/128.2 mozilla: Type confusion when looking up a property name in a "with" block CVE-2024-8381 mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener...