CVE-2022-25610

Unauthenticated Stored Cross-Site Scripting XSS in Simple Ajax Chat = 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit...

Cross site scripting

Unauthenticated Stored Cross-Site Scripting XSS in Simple Ajax Chat = 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit...

CVE-2022-25610 WordPress Simple Ajax Chat plugin <= 20220115 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS in Simple Ajax Chat = 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to exploit...

CVE-2022-25610

CVE-2022-25610 affects the WordPress plugin Simple Ajax Chat ≤ 20220115. The vulnerability is an unauthenticated Stored Cross-Site Scripting (XSS) due to insufficient data validation/filtering of user input and output, allowing an attacker to store malicious code. Multiple connected sources corro...

WordPress plugin Simple Ajax Chat 跨站脚本漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Simple Ajax Chat plugin version 20220115 and earlier versions have a cross-site scripting vulnerability that stem...

PT-2022-17405 · Unknown · Simple Ajax Chat

Name of the Vulnerable Software and Affected Versions: Simple Ajax Chat versions = 20220115 Description: The issue is related to Unauthenticated Stored Cross-Site Scripting XSS, which allows an attacker to store malicious code. However, the attack requires specific conditions, making it hard to...

Zulip Competition Conditions Issue Vulnerability

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, a contention issue vulnerability exists in Zulip versions 4.0 and prior to 4.11, which stems from the fact that Zul...

Cross site scripting

A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sendChatData.php does not properly validate the value of the "n" POST parameter. Through this vulnerability, an attacker is capable to execute malicious JavaScript code...

CVE-2021-39734

In sendMessage of OneToOneChatImpl.java ? TBD, there is a possible way to send an RCS message without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-24751

CVE-2022-24751 describes a race condition in Zulip during account deactivation. From versions 4.0 up to, but not including, 4.11, a deactivated user could in rare cases retain access due to concurrent actions. The fixes are in Zulip 4.11 on the 4.x branch and 5.0-rc1 on the 5.x branch. Upgrading ...

CVE-2022-24751 Race condition in Zulip

Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A...

CVE-2021-41181 Nextcloud Talk app exposes chat messages on lockscreen

Nextcloud talk is a self hosting messaging service. In versions prior to 12.3.0 the Nextcloud Android Talk application did not properly detect the lockscreen state when a call was incoming. If an attacker got physical access to the locked phone, and the victim received a phone call the attacker...

Talk app did allow access to sensitive chat messages on lockscreen

None...

Nextcloud Talk 授权问题漏洞

Nextcloud Talk is a self-hosted local audio/video and chat communication service from Nextcloud Germany. Nextcloud Talk suffers from an authorization issue vulnerability that stems from the fact that in versions prior to 12.3.0, the Nextcloud Android Talk app fails to properly detect a locked...

Conti Ransomware Group Diaries, Part III: Weaponry

Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what its like to be an employee of Contis sprawling organization. Todays Part III looks at how Conti abused popular commercial...

Zulip Cross-Site Scripting Vulnerability (CNVD-2022-17016)

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, Zulip suffers from a cross-site scripting vulnerability that stems from the WEB application's lack of proper...

CVE-2022-23656

Zulip Server (main branch, from June 2021 onward) is vulnerable to a cross-site scripting (XSS) issue on the recent topics page. The vulnerability arises from insufficient validation of client-side data, allowing an attacker to craft a malicious full name and trigger JavaScript execution when a v...

Conti chat logs leaked as ransomware gang sides with Russia

By Waqas The individual responsible for leaking Conti chat logs has warned the ransomware gang that more files will be… This is a post from HackRead.com Read the original post: Conti chat logs leaked as ransomware gang sides with Russia...

The Conti ransomware leaks

On February 27, an individual with insights into the Conti ransomware group started leaking a treasure trove of data beginning with internal chat messages. Conti is responsible for a number of high profile attacks, including one against the Irish Healthcare system which has cost more than $48...

Conti Ransomware Group Internal Chats Leaked Over Russia-Ukraine Conflict

UPDATE: As of March 2, 2022, Conti began taking down exposed infrastructure as a result of the chat disclosure. At that time, we assessed that due to their sophisticated capability, deep funding, and quick recovery from exposed infrastructure in November 2021, they remained an active and...