Live Chat - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Live Chat published at the 'play' market has multiple vulnerabilities...

Disabled PadCrypt Ransomware Includes Live Chat, Uninstaller

Several flavors of ransomware, most notably Cryptowall, have come packaged with support features. But a new piece of crypto-ransomware called PadCrypt has upped the game with a live chat feature that victims can use to interact with the attackers about ransom payments and other information...

Shopify: [livechat.shopify.com] Cookie bomb at customer chats

When we visit the https://livechat.shopify.com/customer/chats/new page the ref and ssid URL parameters are used to set cookie values the way as follows: var getURLParameter = functionname return decodeURIComponentnew RegExp'?|&' + name + '=' + '^&;+?&||;|$'.execlocation.search||,""1.replace/+/g,...

WP Live Chat Support < 4.4.0 - Unauthenticated Blind SQL Injection

The 3CX Live Chat WordPress plugin was affected by an Unauthenticated Blind SQL Injection security vulnerability...

WordPress Live Chat Support Plugin <= 4.3.5 - Unauthenticated Blind SQL Injection

Because of this vulnerability, unauthenticated remote attackers can execute arbitrary SQL commands. Solution Update the plugin...

CVE-2015-2039: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings or 2 conduct cross-site scripting XSS attacks via the acobottok...

PT-2015-5560

Name of the Vulnerable Software and Affected Versions Acobot Live Chat & Contact Form plugin version 2.0 Description The issue allows remote attackers to hijack the authentication of administrators for requests, enabling them to change plugin settings or conduct cross-site scripting XSS attacks...

WordPress Acobot Live Chat & Contact Form Plugin <= 2.0 - Multiple CSRF

Because of these vulnerabilities, the attackers can hijack the authentication of administrators for requests that change plugin settings or conduct cross-site scripting attacks. Solution Upgrade the plugin...

WordPress Acobot Live Chat And Contact Form 2.0 CSRF / XSS

Title: WordPress 'Acobot Live Chat & Contact Form' CSRF/XSS Version: 2.0 Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2015/01/26 Download: https://wordpress.org/plugins/acobot/ Contacted WordPress: 2015/01/26 ========================================================== Plugin descriptio...

LiveSupporti 1.0 - Stored Cross-Site Scripting (XSS)

The Free Live Chat Support WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

ClickDesk <= 4.3 - Live Chat Widget Multiple Field XSS

The Live Chat from ClickDesk – Live Chat – Help Desk Plugin for Websites WordPress plugin was affected by a Live Chat Widget Multiple Field XSS security vulnerability...

WP Live Chat Support < 4.1.0 - XSS

The 3CX Live Chat WordPress plugin was affected by a XSS security vulnerability...

CVE-2014-4513

Multiple cross-site scripting XSS vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 MESSAGE, 2 EMAIL, or 3 NAME parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 MESSAGE, 2 EMAIL, or 3 NAME parameter...

CVE-2014-4513

Multiple cross-site scripting XSS vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 MESSAGE, 2 EMAIL, or 3 NAME parameter...

CVE-2014-4513

ActiveHelper LiveHelp Server 3.1.0 (WordPress plugin) contains multiple XSS flaws in server/offline.php, exploitable via the MESSAGE, EMAIL, or NAME parameters. Root cause: reflected/stored input not properly sanitized, allowing arbitrary script/HTML injection. Impact: potential theft or manipula...

PT-2014-5943

Name of the Vulnerable Software and Affected Versions ActiveHelper LiveHelp Live Chat plugin versions 3.1.0 and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the...

joomla live chat (sql/proxy) Multiple Vulnerabilities

No description provided by source. Joomla Live Chat http://www.joompolitan.com/livechat.html Google Dork: allinurl:option=comlivechat author: jdc SQL Injections: administrator/components/comlivechat/getChat.php && administrator/components/comlivechat/getSavedChatRooms.php don't sanitize the...

CVE-2014-4513: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in server/offline.php in the ActiveHelper LiveHelp Live Chat plugin 3.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 MESSAGE, 2 EMAIL, or 3 NAME parameter...

ClickDesk 4.3 Cross Site Scripting

ClickDesk Multiple Persistent XSS Details ======================================================================================== Product: ClickDesk a cross platform live chat and support plugin Security-Risk: High Remote-Exploit: yes Vendor-URL: https://www.clickdesk.com/ Advisory-Status:...