CVE-2023-4497

CVE-2023-4497 affects Easy Chat Server (version 3.1 and earlier). The vulnerability is a stored XSS in the Icon parameter, reachable via POST to /registresult.htm and loading data from /users.ghp. Descriptions in multiple sources confirm the issue; CVSS v3.1 base score 6.1 (MEDIUM) with network a...

CVE-2023-4497 Easy Chat Server XSS vulnerability

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /registresult.htm POST method, in the Icon parameter. The XSS is loaded from /users.ghp...

CVE-2023-4496 Easy Chat Server XSS vulnerability

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /body2.ghp POST method, in the mtowho parameter...

CVE-2023-4496 Easy Chat Server XSS vulnerability

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /body2.ghp POST method, in the mtowho parameter...

CVE-2023-4496

CVE-2023-4496 affects Easy Chat Server (version 3.1 and earlier). The vulnerability is a stored Cross-Site Scripting (XSS) in the mtowho parameter of the POST endpoint /body2.ghp, caused by insufficient input encryption. Impact details are limited to XSS risk; no exploit details or active exploit...

CVE-2023-4495 Easy Chat Server XSS vulnerability

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /registresult.htm POST method, in the Resume parameter. The XSS is loaded from /register.ghp...

CVE-2023-4495 Easy Chat Server XSS vulnerability

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /registresult.htm POST method, in the Resume parameter. The XSS is loaded from /register.ghp...

CVE-2023-4495

The CVE-2023-4495 entry documents an XSS vulnerability in Easy Chat Server (version 3.1 and earlier). The issue arises from insufficient sanitization of user-controlled input stored via the POST endpoint /registresult.htm in the Resume parameter, with the XSS payload being loaded from /register.g...

CVE-2023-4494 Easy Chat Server Stack-based buffer overflow vulnerability

Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file asking for the name via a GET request resulting in arbitrary code execution on the remote machine...

CVE-2023-4494 Easy Chat Server Stack-based buffer overflow vulnerability

Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file asking for the name via a GET request resulting in arbitrary code execution on the remote machine...

CVE-2023-4494

CVE-2023-4494 concerns Easy Chat Server 3.1. It is described as a stack-based buffer overflow in the handling of a username when accessed via the register.ghp file through a GET request, potentially enabling arbitrary code execution on the remote host. The vulnerability is rated with a high/criti...

CVE-2023-4493 Easy Address Book Web Server Stored XSS vulnerability

Stored Cross-Site Scripting in Easy Address Book Web Server 1.6 version, through the usersadmin.ghp file that affects multiple parameters such as firstname, homephone, lastname, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip. This vulnerability allows a...

CVE-2023-4493

CVE-2023-4493 describes a stored XSS in Easy Address Book Web Server 1.6 via the users_admin.ghp file, enabling a remote attacker to inject JavaScript that executes when the target page loads, potentially compromising integrity. Affected parameters include firstname, homephone, lastname, middlena...

CVE-2023-4492 Easy Address Book Web Server XSS vulnerability

Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate and workzip of the /addrbook.ghp file, allowing an attacker to inject a JavaScript payload specially designed to...

CVE-2023-4492

CVE-2023-4492 is an XSS vulnerability in Easy Address Book Web Server 1.6 affecting multiple parameters in the /addrbook.ghp page (firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate, workzip). The issue allows injecting a JavaScript payload that r...

CVE-2023-4492 Easy Address Book Web Server XSS vulnerability

Vulnerability in Easy Address Book Web Server 1.6 version, affecting the parameters firstname, homephone, lastname, middlename, workaddress, workcity, workcountry, workphone, workstate and workzip of the /addrbook.ghp file, allowing an attacker to inject a JavaScript payload specially designed to...

CVE-2023-4491 Easy Address Book Web Server Buffer overflow vulnerability

Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long username string to /searchbook.ghp, asking for the name via a POST request, resulting in arbitrary code execution on the remote machine...

CVE-2023-4491

CVE-2023-4491 affects Easy Address Book Web Server 1.6. It is a remote buffer overflow in the /searchbook.ghp API endpoint triggered by sending an overly long username string via POST, leading to arbitrary code execution on the remote host. The CVE is rated 9.8/CRITICAL (CVSS 3.1) with Network at...

CVE-2023-4491 Easy Address Book Web Server Buffer overflow vulnerability

Buffer overflow vulnerability in Easy Address Book Web Server 1.6 version. The exploitation of this vulnerability could allow an attacker to send a very long username string to /searchbook.ghp, asking for the name via a POST request, resulting in arbitrary code execution on the remote machine...

CVE-2023-4497: Improper Neutralization of Input During Web Page Generation

Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability stored via /registresult.htm POST method, in the Icon parameter. The XSS is loaded from /users.ghp...