7925 matches found
GHSA-G9RQ-X4FJ-F5HX Remote Code Execution Through Image Uploads in BookStack
Impact A user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area o...
Work remotely, stay secure—guidance for CISOs
With many employees suddenly working from home, there are things an organization and employees can do to help remain productive without increasing cybersecurity risk. While employees in this new remote work situation will be thinking about how to stay in touch with colleagues and coworkers using...
XSS Vulnerability in WisdomTooth's Manual Online Customer Service Chat Service
Beijing Wisdom Tooth Bochuang Technology Co., Ltd. is a provider of intelligent full customer service platform. A cross-site scripting vulnerability exists in WisdomTooth's manual online customer service chat. An attacker can insert malicious js code into the page to obtain user cookies and other...
LiveZilla Live Chat Elevation of Privilege Vulnerability
LiveZilla Live Chat is a free online customer service system from the German company LiveZilla. The system provides real-time monitoring of visitors, offline messages, GeoTracking map tracking, access statistics, online chat and other features. A security vulnerability exists in the 'name' functi...
CVE-2020-9758
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...
CVE-2020-9758
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...
CVE-2020-9758
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...
Design/Logic Flaw
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...
CVE-2020-9758
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...
CVE-2020-9758
LiveZilla Live Chat 8.0.1.3 (Helpdesk) is affected by CVE-2020-9758 due to a blind JavaScript injection in chat.php (name parameter). This stored XSS can reveal usernames/passwords stored in the database via the mobile/chat URI (lgn/psswrd), enabling privilege escalation from unauthenticated to u...
CVE-2019-20502
An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter...
CVE-2019-20502
An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter...
Buffer overflow
An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter...
CVE-2019-20502
The CVE-2019-20502 entry applies to EFS Easy Chat Server 3.1, describing a buffer overflow triggered by a long body2.ghp message parameter. Connected sources (Red Hat CVE, NVD/NVD variants) confirm the affected product and the underlying issue, but do not provide exploit details or remediation st...
CVE-2019-20502
An issue was discovered in EFS Easy Chat Server 3.1. There is a buffer overflow via a long body2.ghp message parameter...
Mail.ru: web.icq.com XSS in chat message via contact info
XSS in web.icq.com via chat message with contact details...
Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin) Exploit
Exploit for php platform in category web applications Exploit Title: Business Live Chat Software 1.0 - Cross-Site Request Forgery Add Admin Description: Operator Can Change Role User Type to admin Exploit Author: Meisam Monsef Vendor Homepage: https://www.bdtask.com/business-live-chat-software.ph...
Business Live Chat Software 1.0 Cross Site Request Forgery
Exploit Title: Business Live Chat Software 1.0 - Cross-Site Request Forgery Add Admin Description: Operator Can Change Role User Type to admin Date: 2020-02-26 Exploit Author: Meisam Monsef Vendor Homepage: https://www.bdtask.com/business-live-chat-software.php Version: V-1.0 Tested on: ubuntu...
Easy Chat Server 3.1 Unquoted Service Path
Exploit Title: Easy Chat Server v3.1 - 'Easy Chat Service' Unquoted Service Path Exploit Author: boku Date: 02/10/2020 Vendor Homepage: http://www.echatserver.com/ Software Link: http://www.echatserver.com/ecssetup.exe Version: 3.1 Tested On: Windows 10 32-bit Recreate: 1 Download & install Easy...