CVE-2025-48474

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application incorrectly checks user access rights for conversations. Users with showonlyassignedconversations enabled can assign themselves to an arbitrary conversation from the mailbox to which they have...

CVE-2022-2080

The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see...

CVE-2020-9379

The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB496276 allows an authenticated user to access sensitive information. A successful exploit could allow unauthorized access to user conversations...

CVE-2015-9285

esoTalk 1.0.0g4 has XSS via the PATHINFO to the conversations/ URI...

Malicious code in crisp-import-conversations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 695e694069b00b1d669921e34a38537e57d625a52cebab80f5ae8af1221b8377 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WhatsApp Adds Advanced Chat Privacy to Blocks Chat Exports and Auto-Downloads

WhatsApp has introduced an extra layer of privacy called Advanced Chat Privacy that allows users to block participants from sharing the contents of a conversation in traditional chats and groups. "This new setting available in both chats and groups helps prevent others from taking content outside...

Dust: Privilege Escalation leads to Unauthorized Access to Private Conversations By any Regular user [Read , Edit and Delete]

Summary: A normal authenticated user on dust.tt can escalate their privileges by accessing, modifying, and deleting any chat threads belonging to other users — including administrators — through a vulnerable API endpoint without having the appropriate permissions. Vulnerability Details: Reading...

Unblu Spark 安全漏洞

Unblu Spark is a key component in a conversation-centered digital customer experience platform from Swiss company Unblu. A security vulnerability exists in Unblu Spark that stems from the ability of conversation participants to replace uploaded files...

CVE-2024-13740

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pmmessengershowmessages function due to missing validation on a user controlled key. This makes it possible for...

CVE-2024-13740

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pmmessengershowmessages function due to missing validation on a user controlled key. This makes it possible for...

PT-2025-6605 · WordPress · Profilegrid

Name of the Vulnerable Software and Affected Versions: ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.9.4.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to read private conversations of othe...

PT-2025-5302 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: visionOS versions prior to 2.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 macOS Sequoia versions prior to 15.3 watchOS versions prior to 11.3 tvOS versions prior to 18.3 Description: A type confusion issue was addressed with...

CVE-2024-54142

CVE-2024-54142 concerns the Discourse AI plugin for Discourse. When sharing Discourse AI Bot conversations into posts, HTML entities in the conversation could leak into the application when a user visits a post with a onebox, enabling cross-site scripting via user-visible content. The issue is ti...

Apple to Pay Siri Users $20 Per Device in Settlement Over Accidental Siri Privacy Violations

Apple has agreed to pay $95 million to settle a proposed class action lawsuit that accused the iPhone maker of invading users' privacy using its voice-activated Siri assistant. The development was first reported by Reuters. The settlement applies to U.S.-based individuals current or former owners...

Malicious code in conversations-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e54647ae689c5f7d3193ceb233f106eac2255d584c793de83b7de77dd086b2dc The OpenSSF Package Analysis project identified 'conversations-embed' @ 1.21.0 npm as malicious. It is considered malicious because: - The packa...

MAL-2024-12093 Malicious code in conversations-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e54647ae689c5f7d3193ceb233f106eac2255d584c793de83b7de77dd086b2dc The OpenSSF Package Analysis project identified 'conversations-embed' @ 1.21.0 npm as malicious. It is considered malicious because: - The packa...

Malicious code in support-conversations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edda50ab2f0ce5968a008967fbb252094f125171a8759dc97957ee5f7d8d8826 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11847 Malicious code in support-conversations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edda50ab2f0ce5968a008967fbb252094f125171a8759dc97957ee5f7d8d8826 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GSMA Plans End-to-End Encryption for Cross-Platform RCS Messaging

The GSM Association GSMA, the governing body that oversees the development of the Rich Communications Services RCS protocol, on Tuesday, said it's working towards implementing end-to-end encryption E2EE to secure messages sent between the Android and iOS ecosystems. "The next major milestone is f...

CVE-2024-45050 Ringer Server Does Not Check Members When Loading Messages

Ringer server is the server code for the Ringer messaging app. Prior to version 1.3.1, there is an issue with the messages loading route where Ringer Server does not check to ensure that the user loading the conversation is actually a member of that conversation. This allows any user with a Lif...