Cross site scripting

A cross-site scripting XSS vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat text field...

PT-2022-27380 · Unknown · Expense Tracker

Name of the Vulnerable Software and Affected Versions: Expense Tracker version 1.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat text field. Recommendations: For Expense Tracker version 1.0,...

Zoom Client for Meetings < 4.1.34460.1105 Vulnerability (ZSB-18001)

The version of Zoom Client for Meetings installed on the remote host is prior to 4.1.34460.1105. It is, therefore, affected by a vulnerability as referenced in the ZSB-18001 advisory. - A vulnerability in the Zoom client could allow a remote, unauthenticated attacker to control meeting...

Zoom Client for Meetings < 5.7.3 Vulnerability (ZSB-21021)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.7.3. It is, therefore, affected by a vulnerability as referenced in the ZSB-21021 advisory. - The Zoom Client for Meetings before version 5.7.3 for Android, iOS, Linux, macOS, and Windows contain a server side...

Expense Tracker 跨站脚本漏洞

Expense Tracker is an expense tracker organized by SourceCode and Projects. A security vulnerability exists in Expense Tracker version 1.0 that originates in cross-site scripting XSS and allows an attacker to execute arbitrary web script or HTML via a crafted payload injected into a chat text fie...

Probing Weaponized Chat Applications Abused in Supply-Chain Attacks

This report examines the infection chain and the pieces of malware used by malicious actors in supply-chain attacks that leveraged trojanized installers of chat-based customer engagement platforms...

HCL Technologies HCL Sametime 安全漏洞

HCL Technologies HCL Sametime is a conferencing solution from HCL Technologies, USA. A security vulnerability exists in HCL Technologies HCL Sametime 12 that stems from an anonymous user logging in and being able to browse the user directory and potentially create chats with internal users...

Important: thunderbird

Issue Overview: Integer overflow vulnerability in avtimecodemakestring in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service DoS via crafted .mov file. CVE-2021-28429 When receiving an HTML email that contained an iframe element, which used a srcdoc...

CVE-2022-3858

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin...

Sql injection

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin...

PT-2022-24468 · WordPress · The Floating Chat Widget

Name of the Vulnerable Software and Affected Versions: The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin versions prior to 3.0.3 Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter...

CVE-2022-44955

webtareas 2.4p5 was discovered to contain a cross-site scripting XSS vulnerability in the Chat function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Messages field...

Cross site scripting

webtareas 2.4p5 was discovered to contain a cross-site scripting XSS vulnerability in the Chat function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Messages field...

webTareas 跨站脚本漏洞

webTareas is a web-based open source collaboration tool. The product supports features such as project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas version 2.4p5, which stems from the discovery of a cross-site scripting XSS...

PT-2022-27355 · Webtareas · Webtareas

Name of the Vulnerable Software and Affected Versions: webtareas version 2.4p5 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Messages field in the Chat function. This enables the execution of malicious code, potentially...

CVE-2022-44955

CVE-2022-44955 affects webtareas version 2.4p5, where a cross-site scripting (XSS) vulnerability exists in the Chat function. The vulnerability allows an attacker to inject a crafted payload into the Messages field to execute arbitrary web scripts or HTML. Documented impact is limited to the abil...

CVE-2022-44955

webtareas 2.4p5 was discovered to contain a cross-site scripting XSS vulnerability in the Chat function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Messages field...

Line Corporation Line Client For iOS Denial Of Service Vulnerability

Line Client For iOS is a messaging application from Line Corporation, Japan. A denial of service vulnerability exists in Line Client For iOS prior to version 12.17.0, which originates from line client for iOS crashing in a group chat when an invalid e2ee key is shared, and can be exploited by an...

CVE-2022-42446

Sametime 12 and later allows anonymous users by default, enabling after-login access to browse the User Directory and potentially initiate chats with internal users. Root cause involves anonymous access being active, which exposes directory lookup functionality. Remediation across sources include...

Discourse Information Disclosure Vulnerability (CNVD-2022-85501)

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. An information disclosure vulnerability exists in Discourse versions 2.8.1 and earlier, and 2.9.0.beta.13 and earlier. An attacker can exploit this vulnerability to...