Cross-Site Request Forgery (CSRF) in convos-chat/convos

Description An attacker is able to log out a user if a logged-in user visits the attacker's website. Proof of Concept history.pushState'', '', '/' Impact This vulnerability is capable of forging users to unintentional logout. More Detail One way GET could be abused here is that a person competito...

Nordaaker Convos Password Management Vulnerability

Nordaaker Convos is a Norwegian company Nordaaker's Web browser-based open source multi-user chat application . A security vulnerability exists in the Core/Settings.pm and Util.pm files in Nordaaker Convos versions prior to 4.20. The vulnerability stems from a poorly designed or implemented probl...

CVE-2020-14423

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...

CVE-2020-14423

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...

CVE-2020-14423

Convos (Nordaaker Convos) before version 4.20 uses an insecure random secret in Core/Settings.pm and Util.pm, leading to a predictable CONVOS_LOCAL_SECRET that affects password resets and invitations. Affected: Convos prior to 4.20. Root cause: improper randomness in secret generation. Impact: pa...

CVE-2020-14423

Convos before 4.20 does not properly generate a random secret in Core/Settings.pm and Util.pm. This leads to a predictable CONVOSLOCALSECRET value, affecting password resets and invitations...