WordPress All Users Messenger Plugin <= 1.24 is vulnerable to Broken Access Control

Software All Users Messenger Type Plugin Vulnerable versions = 1.24 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-4023 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID db4d05aa5b71 Credits Dmitrii Ignatyev Required...

Important: kernel

Issue Overview: An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfssetea in fs/ntfs3/xattr.c. CVE-2022-48502 A side channel vulnerability on some of the AMD CPUs may allow a...

All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR

Description The plugin does not prevent non-administrator users from deleting messages from the all-users messenger. 1 Go to the messenger 2 Catch a request that is constantly running at intervals of 3 seconds 3 Change the message time argument to true 4 Set true for permission to delete a commen...

CVE-2023-3434 QRC Handler without Input Validation in Jami

Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami version 20222284 on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger...

PT-2023-24825 · Microsoft · Windows Qrc Handler

Name of the Vulnerable Software and Affected Versions: Jami version 20222284 Description: The issue is related to improper input validation in hyperlink interpretation. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami...

New Zero-Click Hack Targets iOS Users with Stealthy Root-Privilege Malware

A previously unknown advanced persistent threat APT is targeting iOS devices as part of a sophisticated and long-running mobile campaign dubbed Operation Triangulation that began in 2019. "The targets are infected using zero-click exploits via the iMessage platform, and the malware runs with root...

CVE-2023-31983

creationtimestamp| type| source ---|---|--- 2023-05-12 20:26:57+00:00| seen| https://t.me/cibsecurity/64037...

WordPress WP-Chatbot for Messenger Plugin <= 4.7 is vulnerable to Broken Access Control

Software WP-Chatbot for Messenger Type Plugin Vulnerable versions = 4.7 Fixed in 4.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32581 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 86362c6f5292 Credits István Márton Required...

CVE-2023-30096

A stored cross-site scripting XSS vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user information field...

CVE-2023-30097

A stored cross-site scripting XSS vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the private task field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the private task field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field...

CVE-2023-30096

A stored cross-site scripting XSS vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user information field...

PT-2023-22539 · Unknown · Totaljs Messenger

Name of the Vulnerable Software and Affected Versions: TotalJS messenger affected versions not specified Description: A stored cross-site scripting XSS vulnerability in TotalJS messenger allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the private task...

CVE-2023-30095

CVE-2023-30095 affects TotalJS Messenger (commit b6cf1c9). It describes a stored XSS vulnerability in the channel description field, allowing an attacker to execute arbitrary web scripts or HTML in the context of the affected app. The vulnerability is evidenced across multiple sources, including ...

CVE-2023-30097

CVE-2023-30097 concerns TotalJS messenger. The vulnerability is a stored cross-site scripting (XSS) issue in the messenger, exploitable via a crafted payload injected into the private task field (commit b6cf1c9). Affected software is TotalJS messenger; underlying cause is stored XSS; impact is ex...

CVE-2023-30096

CVE-2023-30096 concerns a stored XSS in TotalJS Messenger (commit b6cf1c9). The vulnerability arises in the user information field, allowing an attacker to inject crafted payloads that execute arbitrary web scripts/HTML when processed by the vulnerable component. Reported impact is limited to cli...

CVE-2023-30095

A stored cross-site scripting XSS vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field...

PT-2023-22537 · Total.Js · Total.Js

Name of the Vulnerable Software and Affected Versions: TotalJS messenger version b6cf1c9 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field. This enables attackers to...

TotalJS messenger 跨站脚本漏洞

TotalJS messenger is a Node.js open source Slack alternative to the Total.js Platform open source. TotalJS Messenger version b6cf1c9 suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload injected into t...