7921 matches found
New Flaw in WordPress Live Chat Plugin Lets Hackers Steal and Hijack Sessions
Security researchers have been warning about a critical vulnerability they discovered in one of a popular WordPress Live Chat plugin, which, if exploited, could allow unauthorized remote attackers to steal chat logs or manipulate chat sessions. The vulnerability, identified as CVE-2019-12498,...
New Flaw in WordPress Live Chat Plugin Lets Hackers Steal and Hijack Sessions
Security researchers have been warning about a critical vulnerability they discovered in one of a popular WordPress Live Chat plugin, which, if exploited, could allow unauthorized remote attackers to steal chat logs or manipulate chat sessions. The vulnerability, identified as CVE-2019-12498,...
Support Board - Chat And Help Desk | Support & Chat <= 1.2.8 Stored XSS
Info: Weak security measures like bad textarea data filtering has been discovered in the «Support Board - Chat And Help Desk | Support & Chat». Demo Website: https://codecanyon.net/item/support-board-chat-and-help-desk/20752085 Backend: https://board.support/desk-demo/?login=true Login / Password...
Support Board - Chat And Help Desk | Support & Chat <= 1.2.8 Stored XSS
Info: Weak security measures like bad textarea data filtering has been discovered in the «Support Board - Chat And Help Desk | Support & Chat». Demo Website: https://codecanyon.net/item/support-board-chat-and-help-desk/20752085 Backend: https://board.support/desk-demo/?login=true Login / Password...
CVE-2019-1870
A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email ECE Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...
CVE-2019-1870 Cisco Enterprise Chat and Email Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Enterprise Chat and Email ECE Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. The vulnerability is due to...
WordPress WP Live Chat Support Pro Arbitrary File Upload Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WP Live Chat Support Pro plugin is a live chat plugin used in it. An arbitrary file upload vulnerability exists in WordPress WP Live Ch...
CVE-2019-11185
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file...
CVE-2019-11185
The CVE-2019-11185 entry affects the WordPress WP Live Chat Support Pro plugin up to version 8.0.26. The vulnerability is an arbitrary file upload in the REST API endpoint remote_upload, caused by an incomplete patch for CVE-2018-12426. An unauthenticated attacker can bypass MIME checks by using ...
PT-2019-12172 · WordPress · Wp Live Chat Support
Name of the Vulnerable Software and Affected Versions: WP Live Chat Support Pro plugin versions through 8.0.26 Description: The issue arises from an incomplete patch, resulting in an arbitrary file upload vulnerability. This vulnerability can be exploited by an unauthenticated remote user...
WP Live Chat Support < 8.0.33 - Missing Permission Checks on some REST API Calls
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...
CVE-2018-20160
CVE-2018-20160 affects ZxChat (ZeXtras Chat) used in Synacor Zimbra Collaboration Suite 8.7/8.8 and related products. The connected sources confirm an XXE attack vector triggered by a crafted XML request to mailboxd as the root cause. Concrete exploit details, affected versions beyond 8.7/8.8, or...
Pidgin 2.13.0 - Denial of Service Exploit
-- coding: utf-8 -- Exploit Title: Pidgin 2.13.0 - Denial of Service PoC Author: Alejandra Sánchez Vendor Homepage: https://pidgin.im/ Software https://cfhcable.dl.sourceforge.net/project/pidgin/Pidgin/2.13.0/pidgin-2.13.0.exe Version: 2.13.0 Tested on: Windows 7, Windows 10 Proof of Concept: 1.-...
CVE-2017-11561
An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...
CVE-2017-11561
An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...
WP Live Chat Support Plugin for WordPress < 8.0.27 Cross-Site Scripting
The WordPress WP Live Chat Support Plugin installed on the remote host is affected by a stored Cross-Site Scripting XSS vulnerability due to improper sanitization of user-supplied input. Note that the scanner has not tested for these issues but has instead relied only on the application's...
WordPress Live Chat with Facebook Messenger plugin <= 1.4.6 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability found in WordPress Live Chat with Facebook Messenger plugin versions = 1.4.6. Solution Update the WordPress Live Chat with Facebook Messenger plugin to the latest available version at least 1.4.7...
WordPress WP Live Chat Support Plugin Fixes XSS Flaw
For the second time this month a patch has been issued for the WordPress add-on called WP Live Chat Support Plugin. This time around it’s a cross-site scripting XSS vulnerability. The WP Live Chat Support is a popular WordPress plugin that allows users to install a pop-up “chat” plugin to their...
