CVE-2019-12964

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject...

CVE-2019-12963

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action...

CVE-2019-12960

LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter pdtsd...

Design/Logic Flaw

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header...

Sql injection

LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter pdtsd...

Design/Logic Flaw

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject...

Deserialization of untrusted data

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action...

Input validation

LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function...

CVE-2019-12964

LiveZilla Server is affected by CVE-2019-12964: a cross-site scripting (XSS) vulnerability in the ticket.php Subject, present in versions prior to 8.0.1.1. Red Hat and NVD entries confirm the issue and indicate remediation via upgrading to 8.0.1.1 or later. The vulnerability is triggered by craft...

CVE-2019-12964

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject...

CVE-2019-12963

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action...

CVE-2019-12963

LiveZilla Server is affected by CVE-2019-12963: prior to 8.0.1.1, the chat.php Create Ticket action is vulnerable to cross-site scripting (XSS). This is confirmed by multiple sources (NVD/Red Hat/CNVD/OpenVAS references) and is characterized by XSS in the Create Ticket/Work Order path. Exploitati...

CVE-2019-12962

LiveZilla Server (8.0.1.0 and earlier) is vulnerable to a reflected XSS in mobile/index.php via the Accept-Language header (CVE-2019-12962). The issue allows injection of JavaScript, potentially exfiltrating session cookies or performing actions on behalf of the victim. Remediation: upgrade to th...

CVE-2019-12962

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header...

CVE-2019-12961

Affected software: LiveZilla Server prior to 8.0.1.1. Issue: CSV injection via the Export Function. Root cause: lack of input sanitization/export handling enabling CSV payloads in exported data. Impact (as described): vulnerability exists in the export feature; CVSS details are provided but the p...

CVE-2019-12961

LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function...

CVE-2019-12960

LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter pdtsd...

CVE-2019-12960

LiveZilla Server contains a SQL Injection vulnerability in functions.internal.build.inc.php via the parameter p_dt_s_d, affecting versions prior to 8.0.1.1. The issue allows an attacker to execute illegal SQL commands with the potential for data disclosure or modification. The CVE entry is corrob...

LiveZilla Server Denial of Service Vulnerability

LiveZilla Server is a free online customer service system from LiveZilla Germany. The system provides real-time monitoring of visitors, offline messages, GeoTracking map tracking, access statistics, online chat and other features. A denial of service vulnerability exists in the knowledgebase.php...

LiveZilla Server SQL Injection Vulnerability

LiveZilla Server is a free online customer service system from LiveZilla Germany. The system provides real-time monitoring of visitors, offline messages, GeoTracking map tracking, access statistics, online chat and other features. A SQL injection vulnerability exists in the server.php file in...