CVE-2019-13974

LayerBB 1.1.3 allows conversations.php/cmd/new CSRF...

Moodle Information Disclosure Vulnerability (CNVD-2019-35819)

Moodle is a learning platform designed to provide educators, administrators, and learners with a powerful, secure, and integrated system for creating personalized learning environments. An information disclosure vulnerability exists in Moodle versions prior to 3.7 and 3.6.4, which stems from the...

Design/Logic Flaw

A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations...

Concrete CMS: Stored XSS in Conversations (both client and admin) when Active Conversation Editor is set to "Rich Text"

Hi concrete5 Team, Summary I've identified Stored XSS vulnerability in concrete5 Conversations module, when Active Conversation Editor is set to "Rich Text". An attacker is able to input malicious JavaScript, which is run in both client agains any site visitor as well as against any user logged...

Code injection

esoTalk 1.0.0g4 has XSS via the PATHINFO to the conversations/ URI...

CVE-2015-9285

CVE-2015-9285 affects esoTalk 1.0.0g4. The vulnerability is a reflected XSS via PATH_INFO to the conversations/ URI. NVD CVSS data: CVSS v2 base score 4.3 (MEDIUM) with network attack vector and no confidentiality impact but partial integrity impact; CVSS v3 base score 6.1 (MEDIUM) with network a...

Vulnerability in French Government Tchap Chat App

A researcher found a vulnerability in the French government WhatsApp replacement app: Tchap. The vulnerability allows anyone to surreptitiously join any conversation. Of course the developers will fix this vulnerability. But it is amusing to point out that this is exactly the backdoor that GCHQ i...

CVE-2018-17997

LayerBB 1.1.1 contains a Cross‑Site Scripting (XSS) vulnerability in the titles of conversations (PMs). The underlying issue is improper handling of input in conversation titles, enabling an attacker to inject scripts that may execute in a victim’s browser. Reports across multiple sources (NVD/Re...

Judging Facebook's Privacy Shift

Facebook is making a new and stronger commitment to privacy. Last month, the company hired three of its most vociferous critics and installed them in senior technical positions. And on Wednesday, Mark Zuckerberg wrote that the company will pivot to focus on private conversations over the public...

Smart Ski Helmet Headphone Flaws Leak Personal, GPS Data

Researchers have found a slew of vulnerabilities in a pair of smart headphones designed to fit under ski helmets. The flaws could allow a bad actor to view victims’ personal information, track them and even listen to their private conversations via the headphones’ walkie-talkie function, which us...

iOS 12.1 passcode bypass hack discovered just few hours after its release

By Waqas Only a few hours have passed since the new iOS 12.1’s release and already its passcode bypass hack has been identified. Through the hack, the attacker can see all the private conversations on a locked iPhone. The passcode bypass hack has been discovered by a Spanish security researcher...

CVE-2018-18467

An issue was discovered in Daniel Gultsch Conversations 2.3.4. It is possible to spoof a custom message to an existing opened conversation by sending an intent...

CVE-2018-18467

An issue was discovered in Daniel Gultsch Conversations 2.3.4. It is possible to spoof a custom message to an existing opened conversation by sending an intent...

CVE-2018-18467

Technical details about CVE-2018-18467 are not publicly available in the provided connected documents. The descriptions across sources reiterate a spoofing via an intent in Conversations 2.3.4. Monitor for updates.

New WhatsApp flaws let attackers hack chats to spread fake news

By Waqas Spreading fake news through WhatsApp was never so easy before. According to the latest research from Check Point security firm, WhatsApp users are at the risk of getting their private chats and group conversations hacked and exploited. Researchers discovered a new wave of attacks that...

Concrete5 Comments on Enumeration Vulnerability

concrete5 is an open source content management system CMS for publishing content on the World Wide Web and intranet. A comment enumeration vulnerability exists in tools/conversations/viewajax.php in Concrete5 before 8.3.0. An unauthenticated user can exploit this vulnerability by posting a reques...

Skype Finally Adds End-to-End Encryption for Private Conversations

Good news for Skype users who are concerned about their privacy. Microsoft is collaborating with popular encrypted communication company Signal to bring end-to-end encryption support to Skype messenger. End-to-end encryption assured its users that no one, not even the company or server that...

Microsoft Cortana Can Now Read Your Skype Messages to Make Chat Smarter

Microsoft today announced built-in support for Cortana—an artificial intelligence-powered smart assistant—in Skype messenger on Android as well as iOS devices. What purpose does it serve? Microsoft wants its AI-based smart assistance to understand your conversations and help you with quick...

FreeMilk Phishing Scam Hijacks Active Email Conversations to Deploy Malware

By Waqas The IT security researchers at Palo Alto Networks Unit 42 This is a post from HackRead.com Read the original post: FreeMilk Phishing Scam Hijacks Active Email Conversations to Deploy Malware...

Twitter OSINT Tool Tinfoleak

tinfoleak is an open-source tool within the OSINT Open Source Intelligence and SOCMINT Social Media Intelligence disciplines, that automates the extraction of information on Twitter and facilitates subsequent analysis for the generation of intelligence. Taking a user identifier, geographic...