Cross site scripting

A Stored Cross Site Scripting XSS issue exists in Convos-Chat before 6.32...

CVE-2021-42584

A Stored Cross Site Scripting XSS issue exists in Convos-Chat before 6.32...

CVE-2021-42584

Convos-Chat before version 6.32 contains a stored XSS (CVE-2021-42584). The vulnerability allows malicious input to be stored and potentially execute client‑side code. The public documents do not specify the exact root cause, affected subcomponents, exploit details, or a confirmed patch/version t...

Nordaaker Convos 跨站脚本漏洞

Nordaaker Convos is an open source web browser-based multi-user chat application from Nordaaker, Norway. A cross-site scripting vulnerability exists in Convos-Chat that stems from a stored cross-site scripting XSS issue in Convos-Chat prior to 6.32. An attacker could exploit the vulnerability to...

CVE-2021-42584: Improper Neutralization of Input During Web Page Generation

A Stored Cross Site Scripting XSS issue exists in Convos-Chat before 6.32...

in convos-chat/convos

Description Hi there, I would like to report a vulnerability that allows a hacker to upload dangerous file type in convos. Proof of Concept Go to a conversation and click on upload file, then upload a file. The request to upload file looks like this: POST /api/files.json HTTP/1.1 Host:...

Cross-Site Request Forgery (CSRF) in convos-chat/convos

Description An attacker is able to log out a user if a logged-in user visits the attacker's website. Proof of Concept history.pushState'', '', '/' Impact This vulnerability is capable of forging users to unintentional logout. More Detail One way GET could be abused here is that a person competito...

Nordaaker Convos Password Management Vulnerability

Nordaaker Convos is a Norwegian company Nordaaker's Web browser-based open source multi-user chat application . A security vulnerability exists in the Core/Settings.pm and Util.pm files in Nordaaker Convos versions prior to 4.20. The vulnerability stems from a poorly designed or implemented probl...

CVE-2020-14423

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...

CVE-2020-14423

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...

CVE-2020-14423

Convos (Nordaaker Convos) before version 4.20 uses an insecure random secret in Core/Settings.pm and Util.pm, leading to a predictable CONVOS_LOCAL_SECRET that affects password resets and invitations. Affected: Convos prior to 4.20. Root cause: improper randomness in secret generation. Impact: pa...

CVE-2020-14423

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...

CVE-2020-14423: Use of Insufficiently Random Values

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...