CVE-2022-21650

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

CVE-2022-21650

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

CVE-2022-21649

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

Design/Logic Flaw

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

CVE-2022-21649 Stored XSS via attribute in convos

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

CVE-2022-21649 Stored XSS via attribute in convos

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

CVE-2022-21649

Convos (open source multi-user web chat) is affected by a Stored XSS in chat messages. The vulnerability arises because escaping exists for but not for double quotes, enabling attacker-controlled scripts via the chat window (e.g., injected by https:// links that become tags). The root cause is ...

CVE-2022-21649

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

CVE-2022-21649 Stored XSS via attribute in convos

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

CVE-2022-21650 Stored XSS via html file upload in convos

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

CVE-2022-21650 Stored XSS via html file upload in convos

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

CVE-2022-21650

CVE-2022-21650 describes a stored XSS in Convos, caused by filtering bypass for file uploads: an SVG file uploaded with an .html extension bypasses the upload filter, allowing stored XSS that triggers when a user views the file. The vulnerability affects the Convos web-based chat application and ...

CVE-2022-21650 Stored XSS via html file upload in convos

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

CVE-2022-21650

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

PT-2022-15004

Name of the Vulnerable Software and Affected Versions Convos affected versions not specified Description The issue concerns a stored XSS vulnerability in Convos, an open-source multi-user chat application. It occurs because characters starting with "https://" in the chat window create an tag, and...

CVE-2022-21649: Improper Neutralization of Input During Web Page Generation

Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "" but escaping for double quotes does not exist. Through this...

Nordaaker Convos 跨站脚本漏洞

Nordaaker Convos is an open source web browser-based multi-user chat application from Nordaaker, Norway. Nordaaker Convos suffers from a cross-site scripting vulnerability that stems from the software's lack of effective filtering and escaping of tabbed bracket quotes in the chat window, resultin...

CVE-2022-21650: Improper Neutralization of Input During Web Page Generation

Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...

PT-2022-15005

Name of the Vulnerable Software and Affected Versions Convos affected versions not specified Description The issue concerns Convos, an open-source multi-user chat that runs in a web browser. It is possible to bypass the upload filter by uploading an SVG file with an .html extension, as the chat...

Cross-site Scripting (XSS) - Stored in convos-chat/convos

Description I found a way to bypass the Stored XSS via uploading File with format .svg when chatting in private conversation. Since you have filtered the content of the svg file as below: state $RULES = svg = qr Steps to Reproduce 1.After login, go to any private conversation. 2.In the chat bar,...