Remote Monitoring & Management software used in phishing attacks

Remote Monitoring & Management RMM software, including popular tools like AnyDesk, Atera, and Splashtop, are invaluable for IT administrators today, streamlining tasks and ensuring network integrity from afar. However, these same tools have caught the eye of cybercriminals, who exploit them to...

CVE-2022-4902

A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible ...

Cross site scripting

A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible ...

CVE-2022-4902 eXo Chat Application Mention ExoChatMessageComposer.vue cross site scripting

A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible ...

CVE-2022-4902

The CVE-2022-4902 entry concerns the eXo Chat Application, specifically the Mention Handler within ExoChatMessageComposer.vue. The issue is a cross-site scripting vulnerability in an unknown function of that component, exploitable remotely. The affected versions are prior to 3.3.0-20220417, with ...

CVE-2022-4902 eXo Chat Application Mention ExoChatMessageComposer.vue cross site scripting

A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible ...

PT-2023-15911 · Exo · Exo Chat Application

Name of the Vulnerable Software and Affected Versions: eXo Chat Application versions prior to 3.3.0-20220417 Description: A problematic issue has been found in the eXo Chat Application, affecting an unknown function of the Mention Handler component in the file...

eXo Chat Application 跨站脚本漏洞

Chat Application is an open source instant messaging application for the eXo Platform. A cross-site scripting vulnerability exists in eXo Chat Application. An attacker could exploit this vulnerability to execute cross-site scripting...

CVE-2022-4902: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible ...

Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users

We found APT group Iron Tiger's malware compromising chat application Mimi’s servers in a supply chain attack...

CVE-2021-27771

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID SID. This value is also used when sending chat messages,...

CVE-2021-27771

CVE-2021-27771 affects HCL Sametime (version 11.6 per CNVD) where an attacker can modify the user SID stored in cookies to trigger arbitrary file upload or deletion of directories, leading to a Denial of Service. The vulnerability arises from SID handling within the Sametime chat/file transfer fl...

CVE-2022-24751

CVE-2022-24751 describes a race condition in Zulip during account deactivation. From versions 4.0 up to, but not including, 4.11, a deactivated user could in rare cases retain access due to concurrent actions. The fixes are in Zulip 4.11 on the 4.x branch and 5.0-rc1 on the 5.x branch. Upgrading ...

CVE-2022-24751 Race condition in Zulip

Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A...

CVE-2022-21649 Stored XSS via attribute in convos

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

Cross-site Scripting (XSS) - Stored in zulip/zulip

Description Zulip is a powerful, open source group chat application that combines the immediacy of real-time chat with the productivity benefits of threaded conversations. Zulip is used by open source projects, Fortune 500 companies, large standards bodies, and others who need a real-time chat...

Wire cross-site scripting vulnerability (CNVD-2021-44982)

Wire is a chat software by an individual developer. The program supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original way of saying hello, PING. A cross-site scripting vulnerability exists in wire-webapp, which can be...

Unspecified vulnerability in Zulip server (CNVD-2021-39546)

Zulip server is an open source team chat application from the American company Zulip. A security vulnerability exists in version 3.x prior to Zulip Server 3.4, which stems from the ability of an organization administrator to move messages to streams in other organizations hosted by the same Zulip...

Shopify: Disclose customer orders details by shopify chat application.

Hello Shopify Security Team! Bug Summary: ============= This bug leads to disclose any store orders details including sensitive informations, through shopify chat app. the chat app can retrieve the orders details for unauthorized user. Reproduction steps: ============= - install shopify chat...

CVE-2019-11751

Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks on malicious links in a chat application. This can be used to write a log file to an arbitrary location such as the Windows 'Startup' folder. Note: this issue...