65 matches found
CVE-2022-21830
CVE-2022-21830 concerns a blind self-XSS in Rocket.Chat LiveChat. The vulnerability affects LiveChat versions prior to 1.9, where an attacker could coerce a user into pasting malicious code within the chat, enabling script execution in the victim’s browser. Reported by multiple sources (GHSA, Red...
CVE-2022-21830
A blind self XSS vulnerability exists in RocketChat LiveChat v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance...
CVE-2022-21830
A blind self XSS vulnerability exists in RocketChat LiveChat v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance...
RocketChat LiveChat 跨站脚本漏洞
RocketChat LiveChat is a small, lightweight application from RocketChat Inc. designed to provide B2C business-to-customer communication between agents and website visitors. A cross-site scripting vulnerability exists in RocketChat LiveChat versions prior to 1.9, which can be exploited by an...
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
✍️ Description The questionary section of livehelperchat can be modified listing new question . However, the template is used incorrectly resulting in a CSTI injection which leads to stored XSS. 🕵️♂️ Proof of Concept Install the livechat Go on...
Rocket.Chat: Blind XSS
Blind XSS The page located at https://livechat.coinflex.com/livechat suffers from a Cross-site Scripting XSS vulnerability. XSS is a vulnerability which occurs when user input is unsafely encorporated into the HTML markup inside of a webpage. When not properly escaped an attacker can inject...
Rocket.Chat: Unauthenticated clients can modify Livechat Business Hours
The Meteor method "livechat:saveOfficeHours" allowed unauthenticated clients to modify the global Livechat Business Hours by directly updating the database model...
livechat.8years.com Cross Site Scripting vulnerability OBB-1272338
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
livechat.8seasons.com Cross Site Scripting vulnerability OBB-1267793
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
YouPHPTube 7.7 SQL Injection Vulnerability
Exploit for php platform in category web applications ---------------------------------------------------------------- YouPHPTube = 7.7 getChat.json.php SQL Injection Vulnerability ---------------------------------------------------------------- - Software Link: https://www.youphptube.com -...
YouPHPTube LiveChat Plugin SQL Injection Vulnerability
YouPHPTube is an open source YouTube clone script. A SQL injection vulnerability exists in the LiveChat plugin in YouPHPTube 7.7 and earlier versions. The vulnerability stems from a failure to properly validate user input passed via the livestreamcode POST parameter to...
WordPress LiveChat plugin <= 3.7.2 - Stored Cross-Site Scripting (XSS) and unauthenticated Option Update/Reset vulnerabilities
Stored Cross-Site Scripting XSS and unauthenticated Option Update/Reset vulnerabilities found by Pluginvulnerabilities in WordPress LiveChat plugin versions = 3.7.2. Solution Update the WordPress LiveChat plugin to the latest available version 3.7.4...
LiveChat <= 3.7.2 - Unauthenticated Option Update/Reset and Stored XSS
The lack of proper CSRF and Authorisation checks could allow an unauthenticated attacker to update or reset the plugin's settings. Furthermore, when updating the livechatemail option, no sanitisation is performed, leading to a Stored XSS issue in the plugin's settings page. CSRF and XSS fixed in...
LiveChat <= 3.7.2 - Unauthenticated Option Update/Reset and Stored XSS
The lack of proper CSRF and Authorisation checks could allow an unauthenticated attacker to update or reset the plugin's settings. Furthermore, when updating the livechatemail option, no sanitisation is performed, leading to a Stored XSS issue in the plugin's settings page. CSRF and XSS fixed in...
Mail.ru: XSS в названии лайвчата
Stored XSS in web.icq.com via livechat name...
livechat.igg.com XSS vulnerability
Open Bug Bounty ID: OBB-198928 Description| Value ---|--- Affected Website:| livechat.igg.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Shopify: Stealing livechat token and using it to chat as the user - user information disclosure
Hi , I have found an issue through which an attacker can steal users' livechat access token and use it to login and chat with the support agents as them , he also will be able to get access to sensitive user information such as his email and his first name and last name. Details: When you go to...
joomla组件 LiveChat V2.0 参数last SQL注入漏洞
No description provided by source...
LiveWorld Multiple Products - Cross Site Scripting
LiveWorld Multiple Products - Cross Site Scripting LiveWorld Cross Site Scripting Vendor: LiveWorld, Inc Product: LiveWorld Version: Multiple Products Website: http://www.liveworld.com CVE: CVE-2004-2566 OSVDB: 9180 PACKETSTORM: 34143 Description: LiveWorld provides collaborative services for...
LiveWorld Multiple Products - Cross Site Scripting
LiveWorld Cross Site Scripting Vendor: LiveWorld, Inc Product: LiveWorld Version: Multiple Products Website: http://www.liveworld.com CVE: CVE-2004-2566 OSVDB: 9180 PACKETSTORM: 34143 Description: LiveWorld provides collaborative services for online meetings, customer care, and loyalty marketing...