CVE-2023-33198

tgstation-server (DMAPI chat channel cache) can be poisoned on TGS detach/reattach, causing chat messages to be sent to configured IRC/Discord channels until channels are updated or DreamDaemon is restarted. Affected: tgstation-server and DMAPI cache handling. Remediation: upgrade to tgstation-se...

PT-2023-24215 · Discord · Discord

Name of the Vulnerable Software and Affected Versions: tgstation-server affected versions not specified Description: The issue concerns the DreamMaker API DMAPI chat channel cache in tgstation-server, which can be poisoned upon a restart and reattach of the server. This can lead to chat messages...

PT-2023-22428 · Abstrium · Abstrium Pydio Cells

Name of the Vulnerable Software and Affected Versions: Abstrium Pydio Cells version 4.2.0 Description: A problematic vulnerability has been found in Abstrium Pydio Cells, affecting the component Chat. This issue leads to basic cross-site scripting and can be initiated remotely. The manipulation...

CVE-2023-32687

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...

Code injection

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...

CVE-2023-32687 Insufficiently Protected ChatBot Credentials in tgstation-server

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...

CVE-2023-32687

CVE-2023-32687 affects tgstation-server versions 4.7.0 through 5.12.1, where users with the public list chat bots permission can read chat bot connection strings without the required permission. The issue is patched in version 5.12.1. Remediation: update to 5.12.1; as a workaround, remove the lis...

CVE-2023-32687 Insufficiently Protected ChatBot Credentials in tgstation-server

tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround,...

PT-2023-23962 · Unknown · Tgstation-Server

Name of the Vulnerable Software and Affected Versions: tgstation-server versions 4.7.0 through 5.12.1 Description: The issue allows instance users with the list chat bots permission to read chat bot connection strings without the required permission. This affects a significant number of devices,...

CVE-2023-2882

Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

CVE-2023-23727

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Formilla Live Chat by Formilla plugin = 1.3 versions...

CVE-2023-23727

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Formilla Live Chat by Formilla plugin = 1.3 versions...

kernel: netfilter: nf_conntrack_irc message handling issue

A flaw was found in the Linux kernel in nfconntrackirc where the message handling can be confused and it incorrectly matches on the message. An attacker could exploit this vulnerability to bypass firewall when users are using unencrypted IRC with nfconntrackirc configured...

kernel: netfilter: nf_conntrack_irc message handling issue

A flaw was found in the Linux kernel in nfconntrackirc where the message handling can be confused and it incorrectly matches on the message. An attacker could exploit this vulnerability to bypass firewall when users are using unencrypted IRC with nfconntrackirc configured...

CVE-2023-23727

CVE-2023-23727 is a Stored XSS vulnerability in the WordPress plugin Live Chat by Formilla (Formilla Live Chat) affecting versions up to 1.3. The issue arises from inadequate input sanitization in the admin-facing settings, enabling an authenticated attacker (admin+) to inject scripts. Impact is ...

CVE-2023-23727 WordPress Live Chat by Formilla – Real-time Chat & Chatbots Plugin Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Formilla Live Chat by Formilla plugin = 1.3 versions...

PT-2023-19164 · Formilla · Formilla Live Chat

Name of the Vulnerable Software and Affected Versions: Formilla Live Chat by Formilla plugin versions prior to 1.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For Formilla Live Chat by...

WordPress plugin Live Chat by Formilla 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2023-28356

A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one of the processes, consuming 120% CPU and rendering the service unresponsive...

Design/Logic Flaw

A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one of the processes, consuming 120% CPU and rendering the service unresponsive...