Cross-site Scripting in Moodle Chat

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

CVE-2024-28593

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

UBUNTU-CVE-2024-28593

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

PT-2024-22490 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle version 4.3.3 Description: The Chat activity in Moodle allows students to insert potentially unwanted HTML elements, such as A or IMG elements, or HTML content that can lead to performance degradation. The vendor's documentation notes...

CVE-2024-28593

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

CVE-2024-28593

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

Moodle 安全漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site scripting vulnerability that stems from a Chat activity that allows students to insert potentially...

CVE-2024-28593

The provided sources confirm a vulnerability in Moodle 4.3.3 related to the Chat activity: user-supplied HTML (A/IMG elements) can be inserted, causing performance degradation. Root cause is unbounded HTML content allowed in Chat messages. Documented impact is limited to performance issues; no ex...

CVE-2024-28593

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

CVE-2024-27963 WordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/a through 0.44...

CVE-2024-27963 WordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/a through 0.44...

WordPress Simple Ajax Chat Plugin < 20240223 is vulnerable to Cross Site Scripting (XSS)

Software Simple Ajax Chat Type Plugin Vulnerable versions 20240223 Fixed in 20240223 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1983 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 67c9eb2499f7 Credits fourcade...

CVE-2024-29026

Owncast (github.com/owncast/owncast) is affected by CVE-2024-29026 due to a lenient CORS policy in versions 0.1.2 and earlier, allowing cross-origin requests to read privileged information and potentially leak the admin password. The root cause is improper cross-origin access control, as describe...

CVE-2024-1983

The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users...

CVE-2024-1983

The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users...

CVE-2024-1983 Simple Ajax Chat < 20240223 - Unauthenticated Stored XSS

The Simple Ajax Chat WordPress plugin before 20240223 does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users...

CVE-2024-1983

CVE-2024-1983 affects the WordPress plugin Simple Ajax Chat (formerly Simple Ajax Chat – Add a Fast, Secure Chat Box). The Red Hat/NVD description (and related sources) state the issue is that the plugin does not prevent visitors from using malicious Names in chat, which are reflected unsanitized...

WordPress Plugin Simple Ajax Chat Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-18471 · WordPress · Simple Ajax Chat

Name of the Vulnerable Software and Affected Versions: The Simple Ajax Chat WordPress plugin versions prior to 20240223 Description: The issue concerns the reflection of unsanitized input to other users, specifically when visitors use malicious names in the chat. This allows for potential malicio...

PT-2024-22768 · Unknown +1 · Filecachetools +1

Name of the Vulnerable Software and Affected Versions: Rocket.Chat.Audit through 5ad78e8 Description: The issue arises because Rocket.Chat.Audit depends on filecachetools, which is not available in PyPI. This situation may lead to potential security risks due to the missing dependency...