MAL-2022-1300 Malicious code in azure-communication-chat-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc2fa44f3dac91a94d4ca95f9bc4c6f65554fe4cf95f81c2c61ba6a9e1463654 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-communication-chat-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc2fa44f3dac91a94d4ca95f9bc4c6f65554fe4cf95f81c2c61ba6a9e1463654 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1299 Malicious code in azure-communication-chat-samples-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a41ee4a390154081a997335799ae8718683074f12cd09137981cc79203c6cb9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chat-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adbb94fdf28fcde1a3452a2f9dfb7b4c0dc46bdb48a3858902d42f8e03e7293a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1890 Malicious code in chat-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adbb94fdf28fcde1a3452a2f9dfb7b4c0dc46bdb48a3858902d42f8e03e7293a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

A week in security (June 6 – June 12)

Last week on Malwarebytes Labs: FBI warns of scammers soliciting donations for Ukraine Microsoft autopatch is here…but can you use it? Prometheus ransomwares flaws inspired researchers to try to build a near-universal decryption tool Rotten apples banned from App store Hackers can take over...

Awful 4chan chat bot spouts racial slurs and antisemitic abuse

“A robot may not injure a human being or, through inaction, allow a human being to come to harm” Science fiction readers, and many others, will recognize Asimov’s first law of robotics. After reading about a bot called GPT-4chan I was wondering whether we should include: “A bot may not insult a...

PT-2022-6641 · Cisco · Upstream Works Agent Desktop For Cisco Finesse

Name of the Vulnerable Software and Affected Versions: Upstream Works Agent Desktop for Cisco Finesse versions 4.2.12 and earlier, 5.0 Description: A stored Cross-Site Scripting XSS issue in the Chat gadget allows remote attackers to inject arbitrary web script or HTML via the AttachmentId in the...

BigBlueButton Information Disclosure Vulnerability (CNVD-2022-82638)

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton suffers from an information disclosure vulnerability that stems from the lack of information protection measures and access controls for service meeting announcement chat messages.An attacker...

DEBIAN-CVE-2022-26491

An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicious server. The client will perform TLS certificate verification of the malicious domain name instead of the original XMPP service domain, allowing the attack...

Design/Logic Flaw

BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a...

CVE-2022-29232 Exposure of messages in BigBlueButton public chats

BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a...

CVE-2022-29232 Exposure of messages in BigBlueButton public chats

BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a...

Using Python to unearth a goldmine of threat intelligence from leaked chat logs

Dealing with a great amount of data can be time consuming, thus using Python can be very powerful to help analysts sort information and extract the most relevant data for their investigation. The open-source tools library, MSTICPy, for example, is a Python tool dedicated to threat intelligence. I...

Using Python to unearth a goldmine of threat intelligence from leaked chat logs

Dealing with a great amount of data can be time consuming, thus using Python can be very powerful to help analysts sort information and extract the most relevant data for their investigation. The open-source tools library, MSTICPy, for example, is a Python tool dedicated to threat intelligence. I...

PT-2022-19484 · Unknown · Bigbluebutton

Name of the Vulnerable Software and Affected Versions: BigBlueButton versions 2.2 through 2.3.17 BigBlueButton versions 2.4.0 Description: BigBlueButton is an open source web conferencing system. An attacker, who needs to be a participant in the meeting, could send messages to a locked chat withi...

BigBlueButton 信息泄露漏洞

BigBlueButton is an open source Web conferencing system from the BigBlueButton community.BigBlueButton suffers from an information disclosure vulnerability that stems from the lack of information protection measures and access controls for service meeting announcement chat messages.An attacker...

WordPress JivoChat Live Chat plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in versions of the WordPress JivoChat Live Chat plugi...

Authentication flaw

Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function this.authProvider.verifyAccessKey is an async function, as the code is not using await t...

CVE-2022-31013

Chat Server (Vartalap) vulnerability CVE-2022-31013 affects versions 2.3.2–2.6.0. Root cause is a token validation bug where this.authProvider.verifyAccessKey is treated as asynchronous without awaiting results, enabling authentication bypass. A patch exists in version 2.6.0. Public references ac...