7933 matches found
PT-2023-14570 · Efs · Efs Software Easy Chat Server
Name of the Vulnerable Software and Affected Versions: Efs Software Easy Chat Server version 3.1 Description: The issue allows attackers to execute arbitrary code via a crafted DLL, exploiting a DLL hijacking vulnerability through the TextShaping.dll component. Recommendations: For Efs Software...
CVE-2022-44939
CVE-2022-44939 affects Efs Software Easy Chat Server 3.1; a DLL hijacking flaw in TextShaping.dll allows local attackers to execute arbitrary code via a crafted DLL. Impact: full code execution with high impact. Mitigation/remediation: as per PT-2023-14570, restrict access to TextShaping.dll or a...
Stored HTML injection in Patient chat functionality
Description I've found out that it is possible to inject HTML code in Patient Chat functionality, which allows malicious code to be stored there and potentially affect the other chat users Proof of Concept - Login from the patient portal. I've used the demo instance here:...
CVE-2022-44567
A command injection vulnerability exists in Rocket.Chat-Desktop 3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video...
PT-2022-27252 · Rocket.Chat · Rocket.Chat-Desktop
Name of the Vulnerable Software and Affected Versions: Rocket.Chat-Desktop versions prior to 3.8.14 Description: A command injection issue exists that could allow an attacker to pass a malicious URL to shell.openExternal, potentially leading to remote code execution. This is because the...
CVE-2022-44567
A command injection vulnerability exists in Rocket.Chat-Desktop 3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video...
GHSA-CJCC-46J8-XMR8 destiny.gg chat vulnerable to cross-site request forgery
UNSUPPORTED WHEN ASSIGNED A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is...
CVE-2020-36625
A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is...
CVE-2020-36625
A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is...
Cross site request forgery (csrf)
A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is...
CVE-2020-36625 destiny.gg chat main.go websocket.Upgrader cross-site request forgery
A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is...
destiny.gg chat 跨站请求伪造漏洞
destiny.gg chat is destiny.gg open source a destin.gg chat backend. destiny.gg chat suffers from a cross-site request forgery vulnerability that stems from a problem with the function websocket.Upgrader in the file main.go, which could lead to cross-site request forgery...
CVE-2020-36625
Destiny.gg chat contains a Cross-Site Request Forgery (CSRF) vulnerability affecting the websocket.Upgrader implementation in main.go. The issue enables CSRF due to insufficient validation in the websocket handling path and could be triggered remotely. A patch identified as bebd256fc3063111fb4503...
PT-2022-9020 · Unknown · Destiny.Gg Chat
Name of the Vulnerable Software and Affected Versions: destiny.gg chat affected versions not specified Description: A vulnerability was found in the destiny.gg chat, affecting the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery, and the attack...
CVE-2020-36625 destiny.gg chat main.go websocket.Upgrader cross-site request forgery
A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is...
Click to Chat < 3.18.1 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit...
Click to Chat < 3.18.1 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC Exploit...
FTC Fines Fortnite Maker Epic Games $275 Million for Violating Children's Privacy Law
Epic Games has reached a $520 million settlement with the U.S. Federal Trade Commission FTC over allegations that the Fortnite creator violated online privacy laws for children and tricked users into making unintended purchases in the video game. To that end, the company will pay a record $275...