65 matches found
CVE-2024-37405
Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken pre-authentication and livechat:loadHistory...
CVE-2024-37405
Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken pre-authentication and livechat:loadHistory...
CVE-2024-37405
The CVE-2024-37405 entry concerns Rocket.Chat LiveChat, where two NoSQL injections enable leakage of data: pre-authentication access via livechat:loginByToken and leakage of chat history via livechat:loadHistory. This is a combined, pre-auth scenario affecting the LiveChat component/workflow; the...
RocketChat LiveChat Security Breach
RocketChat LiveChat is a small, lightweight application from RocketChat, Inc. designed to provide B2C business-to-customer communication between agents and website visitors. A security vulnerability exists in RocketChat LiveChat that stems from the presence of a NoSQL injection that can leak...
Rocket.Chat: NoSQL injection leaks visitor token and livechat messages
The Rocket.Chat application was affected by two NoSQL injection vulnerabilities. The first vulnerability allowed leaking visitor tokens by exploiting the livechat:loginByToken method, while the second vulnerability enabled leaking livechat messages by exploiting the livechat:loadHistory method...
LiveChat WooCommerce < 2.2.17 - Cross-Site Request Forgery
Description The WordPress Live Chat Plugin for WooCommerce – LiveChat plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.16. This is due to missing or incorrect nonce validation on several functions in the...
WordPress WordPress Live Chat Plugin for WooCommerce – LiveChat Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)
Software WordPress Live Chat Plugin for WooCommerce – LiveChat Type Plugin Vulnerable versions = 1.0.13 Fixed in 1.0.14 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8bc5490f826...
WordPress WordPress Live Chat Plugin for WooCommerce – LiveChat Plugin <= 2.2.16 is vulnerable to Cross Site Request Forgery (CSRF)
Software WordPress Live Chat Plugin for WooCommerce – LiveChat Type Plugin Vulnerable versions = 2.2.16 Fixed in 2.2.17 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3c6eaa82ffd...
CVE-2023-49821
Cross-Site Request Forgery CSRF vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15...
CVE-2023-49821
Cross-Site Request Forgery CSRF vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15...
CVE-2023-49821 WordPress LiveChat Plugin <= 4.5.15 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15...
CVE-2023-49821 WordPress LiveChat Plugin <= 4.5.15 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15...
CVE-2023-49821
CVE-2023-49821 is a CSRF vulnerability in the WordPress plugin LiveChat – WP Live Chat Plugin for WordPress (affected up to version 4.5.15). The issue stems from missing CSRF checks, enabling potential unauthorized actions by an attacker. Public references indicate the vulnerability exists in ver...
WordPress Plugin LiveChat Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
LiveChat < 4.5.16 - Cross-Site Request Forgery
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
WordPress LiveChat Plugin <= 4.5.15 is vulnerable to Cross Site Request Forgery (CSRF)
Software LiveChat Type Plugin Vulnerable versions = 4.5.15 Fixed in 4.5.16 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-49821 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID fc152f3c5a19 Credits Brandon Roldan Required...
GHSA-HF55-C445-2W97 Cross-site Scripting in @rocket.chat/livechat
A blind self XSS vulnerability exists in RocketChat LiveChat versions lower than 1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance...
