10 matches found
CVE-2020-9758
CVE-2020-9758 説明 LiveZilla Live Chat 8.0.1.3 Helpdesk の chat.php に問題が発見されました。 name パラメータにブラインド JavaScript インジェクションが存在します。 これをトリガーすると、URI 内のヘルプデスク従業員のユーザー名とパスワードを取得できます。 これにより、認証されていない状態からユーザーレベルのアクセスへの権限昇格が発生し、完全なアカウント乗っ取りに至ります。 この攻撃は、データベースに保存されているため複数の認証情報を取得します（ストアドXSS）。 これは、lgn および psswrd...
EUVD-2020-30537
Malware in sbrugna...
EUVD-2018-2879
Malware in sbrugna...
LiveZilla Live Chat Elevation of Privilege Vulnerability
LiveZilla Live Chat is a free online customer service system from the German company LiveZilla. The system provides real-time monitoring of visitors, offline messages, GeoTracking map tracking, access statistics, online chat and other features. A security vulnerability exists in the 'name' functi...
CVE-2020-9758
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...
CVE-2020-9758
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...
Design/Logic Flaw
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...
CVE-2020-9758
An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from unauthenticated to user-level...
