FetLife: Stored XSS via Angular Expression injection via Subject while starting conversation with other users.

The reporter pointed out that the Subject field for sending private messages using FetLife's onsite chat was vulnerable to a stored XSS exploit, allowing people to execute potentially malicious contents on the receiving end of the message...

EulerOS 2.0 SP5 : irssi (EulerOS-SA-2021-1197)

According to the version of the irssi package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow...

Simple Public Chat Room 1.0 - 'msg' Stored Cross-Site Scripting

Exploit Title: Simple Public Chat Room 1.0 - 'msg' Stored Cross-Site Scripting Exploit Author: Richard Jones Date: 2021-01-26 Vendor Homepage: https://www.sourcecodester.com/php/12295/simple-public-chat-room-using-php.html Software Link:...

CVE-2020-8288

The specializedRendering function in Rocket.Chat server before 3.9.2 allows a cross-site scripting XSS vulnerability by way of the value parameter...

CVE-2020-8292

Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting XSS vulnerability via the drag & drop functionality in message boxes...

Simple Public Chat Room 1.0 Cross Site Scripting

Exploit Title: Simple Public Chat Room | Authenticated Stored Cross-Site Scripting Exploit Author: Richard Jones Date: 2021-01-26 Vendor Homepage: https://www.sourcecodester.com/php/12295/simple-public-chat-room-using-php.html Software Link:...

Discourse has an unspecified vulnerability (CNVD-2021-100598)

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.A security vulnerability exists in Discourse 2.7.0, which stems from 2FA's reliance on certain forms rate-limit.No details of the vulnerability are currently available...

Google Research Pinpoints Security Soft Spot in Multiple Chat Platforms

Google Project Zero researcher Natalie Silvanovich outlined what she believes is a common theme when it comes to serious vulnerabilities impacting leading chat platforms. The research, published Tuesday, identifies a common denominator within chat platforms, called “calling state machine”, which...

Google Details Patched Bugs in Signal, FB Messenger, JioChat Apps

In January 2019, a critical flaw was reported in Apple's FaceTime group chats feature that made it possible for users to initiate a FaceTime video call and eavesdrop on targets by adding their own number as a third person in a group chat even before the person on the other end accepted the incomi...

Google Details Patched Bugs in Signal, FB Messenger, JioChat Apps

In January 2019, a critical flaw was reported in Apple's FaceTime group chats feature that made it possible for users to initiate a FaceTime video call and eavesdrop on targets by adding their own number as a third person in a group chat even before the person on the other end accepted the incomi...

Security update for MozillaThunderbird (important)

openSUSE Security Update: Security update for MozillaThunderbird Announcement ID: openSUSE-SU-2021:0127-1 Rating: important References: 1180623 Cross-References: CVE-2020-16044 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update...

Bumble: Bumble API exposes read status of chat messages

Summary The Bumble app allows matches to chat with each other. In the mobile apps it is possible to see whether a message has been delivered the webapp does not offer this feature, but the read status of messages is never disclosed. However, by issuing a POST request to the API endpoint at...

Ali Want Want has dll hijacking vulnerability

Ali Want Want is a very good online chat tool. Ali Want Want has a dll hijacking vulnerability that can be exploited by attackers to gain server control privileges...

Rocket.Chat Security Vulnerability

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat 3.7.1, which can be exploited by an attacker to perform e-mail address enumeration...

CVE-2020-27154

The chat window of Mitel BusinessCTI Enterprise MBC-E Client for Windows before 6.4.11 and 7.x before 7.0.3 could allow an attacker to gain access to user information by sending arbitrary code, due to improper input validation. A successful exploit could allow an attacker to view the user...

Mitel BusinessCTI Enterprise Client Input Validation Error Vulnerability

Mitel Networks BusinessCTI Enterprise is an employee communication software for attendance management and instant messaging from Mitel Networks Canada. An input validation error vulnerability exists in the Windows-based Mitel BusinessCTI Enterprise MBC-E Client Chat Window versions prior to 6.4.1...

Support Live Chat

In more than 4 months since Qualys launched Support Live Chat on the Customer Support Portal, we’ve seen customers use it successfully to get answers to quick support questions. Based on its success, we are scaling internal processes to accommodate greater usage, and we encourage all customers to...

PT-2020-17288 · Ignite Realtime · Openfire

Name of the Vulnerable Software and Affected Versions: Ignite Realtime Openfire version 4.6.0 Description: The issue is related to a Stored XSS in the create-bookmark.jsp file, specifically with the groupchatJID parameter. This allows for potential malicious script execution. Recommendations: For...

Cisco Reissues Patches for Critical Bugs in Jabber Video Conferencing Software

Cisco has once again fixed four previously disclosed critical bugs in its Jabber video conferencing and messaging app that were inadequately addressed, leaving its users susceptible to remote attacks. The vulnerabilities, if successfully exploited, could allow an authenticated, remote attacker to...

Zero-Click Wormable RCE Vulnerability Reported in Microsoft Teams

A zero-click remote code execution RCE bug in Microsoft Teams desktop apps could have allowed an adversary to execute arbitrary code by merely sending a specially-crafted chat message and compromise a target's system. The issues were reported to the Windows maker by Oskars Vegeris, a security...