WP Live Chat Support < 8.0.33 - Missing Permission Checks on some REST API Calls

The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...

CVE-2018-20160

CVE-2018-20160 affects ZxChat (ZeXtras Chat) used in Synacor Zimbra Collaboration Suite 8.7/8.8 and related products. The connected sources confirm an XXE attack vector triggered by a crafted XML request to mailboxd as the root cause. Concrete exploit details, affected versions beyond 8.7/8.8, or...

Pidgin 2.13.0 - Denial of Service Exploit

-- coding: utf-8 -- Exploit Title: Pidgin 2.13.0 - Denial of Service PoC Author: Alejandra Sánchez Vendor Homepage: https://pidgin.im/ Software https://cfhcable.dl.sourceforge.net/project/pidgin/Pidgin/2.13.0/pidgin-2.13.0.exe Version: 2.13.0 Tested on: Windows 7, Windows 10 Proof of Concept: 1.-...

CVE-2017-11561

An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...

CVE-2017-11561

An issue was discovered in ZOHO ManageEngine OpManager 12.2. An authenticated user can upload any file they want to share in the "Group Chat" or "Alarm" section. This functionality can be abused by a malicious user by uploading a web shell...

WP Live Chat Support Plugin for WordPress < 8.0.27 Cross-Site Scripting

The WordPress WP Live Chat Support Plugin installed on the remote host is affected by a stored Cross-Site Scripting XSS vulnerability due to improper sanitization of user-supplied input. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WordPress Live Chat with Facebook Messenger plugin <= 1.4.6 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found in WordPress Live Chat with Facebook Messenger plugin versions = 1.4.6. Solution Update the WordPress Live Chat with Facebook Messenger plugin to the latest available version at least 1.4.7...

WordPress WP Live Chat Support Plugin Fixes XSS Flaw

For the second time this month a patch has been issued for the WordPress add-on called WP Live Chat Support Plugin. This time around it’s a cross-site scripting XSS vulnerability. The WP Live Chat Support is a popular WordPress plugin that allows users to install a pop-up “chat” plugin to their...

VulnCheck KEV: CVE-2019-14950

The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page...

WP Live Chat Support < 8.0.27 - Unauthenticated Stored XSS

The 3CX Live Chat WordPress plugin was affected by an Unauthenticated Stored XSS security vulnerability...

Easy Chat Server 3.1 - message Denial of Service (PoC)

Easy Chat Server 3.1 - message Denial of Service PoC !/usr/bin/python --------------------------------------------------------- Title: Easy Chat Server Version 3.1 - DOS Date: 2019-05-07 Author: Miguel Mendez Z Team: www.exploiting.cl Vendor: http://www.echatserver.com Software Link:...

Easy Chat Server 3.1 Denial Of Service Exploit

!/usr/bin/python --------------------------------------------------------- Title: Easy Chat Server Version 3.1 - DOS Author: Miguel Mendez Z Team: www.exploiting.cl Vendor: http://www.echatserver.com Software Link: http://www.echatserver.com/ecssetup.exe Platforms: Windows Version: 3.1 Tested on:...

WP Live Chat Support Pro - File Upload Bypass

Note: The free and pro version have been merged in WP Live Chat Support 8.0.27...

Easy Chat Server 3.1 Denial Of Service

!/usr/bin/python --------------------------------------------------------- Title: Easy Chat Server Version 3.1 - DOS Date: 2019-05-07 Author: Miguel Mendez Z Team: www.exploiting.cl Vendor: http://www.echatserver.com Software Link: http://www.echatserver.com/ecssetup.exe Platforms: Windows Versio...

Easy Chat Server 3.1 - 'message' Denial of Service (PoC)

!/usr/bin/python --------------------------------------------------------- Title: Easy Chat Server Version 3.1 - DOS Date: 2019-05-07 Author: Miguel Mendez Z Team: www.exploiting.cl Vendor: http://www.echatserver.com Software Link: http://www.echatserver.com/ecssetup.exe Platforms: Windows Versio...

QIWI: Nickname disclosure through web-chat

Nickname disclosure through web-chat...

Cross-site Scripting (XSS)

Apache Pluto Portal is vulnerable to cross-site scripting XSS attack. The input fields to construct a resource URL of the Chat Room are not sanitized properly, allowing an attacker to inject arbitrary script through it...

Apache Pluto Chat Room Demo Portlet Persistent Cross-Site Scripting (CVE-2019-0186)

A cross site scripting vulnerability exists in Apache Pluto. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2019-0186

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting XSS attacks. Mitigation: Uninstall the ChatRoomDemo war file - or - migrate to version 3.1.0 of the chat-room-demo war file...

CVE-2019-0186

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting XSS attacks. Mitigation: Uninstall the ChatRoomDemo war file - or - migrate to version 3.1.0 of the chat-room-demo war file...