Authorization

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat...

CVE-2022-23055

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat...

CVE-2022-23055 ERPNext - Improper user access conrol

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat...

CVE-2022-23055 ERPNext - Improper user access conrol

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send a direct message or a group message to any member or group, impersonating themselves as the administrator. The attacker can also read chat...

CVE-2022-23055

ERPNEXT up to v13.0.2 has a Missing Authorization issue in the chat rooms feature. A low-privilege attacker can impersonate the administrator to send direct or group messages and can read chat messages from groups or users they do not belong to. Root cause described as missing authorization in th...

ERPNext 安全漏洞

ERPNext is an open source enterprise resource planning solution from ERPNext India. A security vulnerability exists in ERPNext versions v11.0.0-beta through v13.0.2, which stems from vulnerability to lack of authorization in chat room functionality, and can be exploited by an attacker to send a...

PT-2022-15815 · Erpnext · Erpnext

Name of the Vulnerable Software and Affected Versions: ERPNext versions v11.0.0-beta through v13.0.2 Description: The issue concerns missing authorization in the chat rooms functionality. A low-privileged attacker can send direct or group messages to any member or group, impersonating themselves ...

WordPress Free Live Chat Support plugin <= 1.0.12 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by Masaki Sunayama in WordPress Free Live Chat Support plugin versions = 1.0.12. Solution Deactivate and delete. This plugin has been closed as of June 14, 2022 and is not available for download. This...

CVE-2022-31095

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the chat message lookup endpoint, primarily...

Design/Logic Flaw

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the chat message lookup endpoint, primarily...

CVE-2022-31095

The CVE-2022-31095 affects the discourse-chat plugin for Discourse. Versions prior to 0.4 allow an attacker who knows a channel message ID to view that message via the chat message lookup endpoint, primarily impacting direct message channels. There are no known workarounds; remediation is to upda...

CVE-2022-31095 Exposure of Sensitive Information in discourse-chat

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the chat message lookup endpoint, primarily...

PT-2022-20523 · Discourse · Discourse-Chat

Name of the Vulnerable Software and Affected Versions: discourse-chat versions prior to 0.4 Description: The issue affects the discourse-chat plugin for the Discourse application, allowing an attacker who knows the message ID for a channel they do not have access to, to view that message using th...

Discourse 信息泄露漏洞

Discourse is an open source community discussion platform. The platform includes features such as communities, email and chat rooms. An information disclosure vulnerability exists in the Discourse plugin discourse-chat prior to version 0.4. An attacker could exploit this vulnerability to obtain...

Malicious code in @sbtweb/chat-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98da8f5b939eeb94617bce10dd625c39b582c21f0057799cdc2ae93196291802 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-576 Malicious code in @sbtweb/chat-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98da8f5b939eeb94617bce10dd625c39b582c21f0057799cdc2ae93196291802 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chat-component-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0eb3edc15c7ab9abb2054403e15205fca87012a8c1c8e6b39408d1072a98ef5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1888 Malicious code in chat-component-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0eb3edc15c7ab9abb2054403e15205fca87012a8c1c8e6b39408d1072a98ef5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cornershop-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edeef1b6a85a30e7ce988441a473e7bbb4b62a35ad13ae4dddbb2873a44c8c98 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wix-chat-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b8ec56558d6c308cf49e57273dfe9e67c582546beafd78d733540abdd4a8395 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...