CVE-2021-45886

CVE-2021-45886 concerns PONTON X/P Messenger before 3.11.2. The flaw is that anti-CSRF tokens are globally valid, creating a weakened CSRF condition where an arbitrary token from a low-privilege user (e.g., operator) can be used to confirm actions of a higher-privilege user (e.g., xpadmin). The p...

CVE-2021-45889

An issue was discovered in PONTON X/P Messenger before 3.11.2. Several functions are vulnerable to reflected XSS, as demonstrated by private/index.jsp?partners/ShowNonLocalPartners.do?localID= or private/index.jsp or private/index.jsp?database/databaseTab.jsp or...

CVE-2021-45889

CVE-2021-45889 affects Ponton X/P Messenger before version 3.11.2. The issue is a reflected XSS vulnerability in multiple endpoints exposed via private/index.jsp and query strings (e.g., partners/ShowNonLocalPartners.do?localID=, databaseTab.jsp, activationMainTab.jsp, serverTab.jsp, emailNotific...

CVE-2021-45888

An issue was discovered in PONTON X/P Messenger before 3.11.2. The navigation tree that is shown on the left side of every page of the web application is vulnerable to XSS: it allows injection of JavaScript into its nodes. Creating such nodes is only possible for users who have the role...

CVE-2021-45888

Ponton X/P Messenger prior to version 3.11.2 is affected by a cross-site scripting (XSS) vulnerability in the left navigation tree of the web UI. The issue allows injection of JavaScript into navigation nodes, and creation of such nodes is restricted to users with the Configuration Administrator ...

PONTON X/P Messenger跨站脚本漏洞

PONTON X/P Messenger is a highly configurable ebXML, AS/1, AS/2, AS/3 and AS/4 compliant messaging software from PONTON Germany. ponton X/P Messenger is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to obtain sensitive user information and construct...

PONTON X/P Messenger 路径遍历漏洞

PONTON X/P Messenger is a highly configurable ebXML, AS/1, AS/2, AS/3 and AS/4 compliant messaging software from the German company PONTON. ponton X/P Messenger is vulnerable to a path traversal vulnerability that could be exploited by an attacker to upload executable scripts while obtaining...

PONTON X/P Messenger 跨站请求伪造漏洞

PONTON X/P Messenger is a highly configurable ebXML, AS/1, AS/2, AS/3 and AS/4 compliant messaging software from PONTON Germany. For example, xpadmin...

How To Make A Messenger App

By Owais Sultan It isnt easy to imagine a modern person without a messenger app. Correspondence in apps has made it… This is a post from HackRead.com Read the original post: How To Make A Messenger App...

CVE-2021-41193

wire-avs is the audio visual signaling AVS component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are...

CVE-2021-41193 Use of Externally-Controlled Format String in wire-avs

wire-avs is the audio visual signaling AVS component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are...

Iranian Hackers Using New Spying Malware That Abuses Telegram Messenger API

An Iranian geopolitical nexus threat actor has been uncovered deploying two new targeted malware that come with "simple" backdoor functionalities as part of an intrusion against an unnamed Middle East government entity in November 2021. Cybersecurity company Mandiant attributed the attack to an...

CVE-2022-24564

creationtimestamp| type| source ---|---|--- 2022-02-22 02:11:39+00:00| seen| https://t.me/cibsecurity/37879...

Voltage SecureMail Server Business Logic Bypass Vulnerability

======================================================================= title: Business Logic Bypass - Mail Relay Post-authenticated product: Voltage SecureMail Server vulnerable version: Voltage SecureMail Server v7.3.0.1 fixed version: Voltage SecureMail Server v7.3.0.1 CVE number: CVE-2021-381...

ASB-A-193890833

In cleardatadlgtext of strings.xml, there is a possible situation when "Clear storage" functionality sets up the wrong security/privacy expectations due to a misleading message. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not...

NSO Group Pegasus Spyware Aims at Finnish Diplomats

The controversial Pegasus spyware, developed by NSO Group, has been found on the devices of Finland’s diplomatic corps serving outside the country as part of a wide-ranging espionage campaign, according to Finnish officials. They also said the infections were of the zero-click variety. “The highl...

Beware of Fake Telegram Messenger App Hacking PCs with Purple Fox Malware

Trojanized installers of the Telegram messaging application are being used to distribute the Windows-based Purple Fox backdoor on compromised systems. That's according to new research published by Minerva Labs, describing the attack as different from intrusions that typically take advantage of...

[SECURITY] Fedora 34 Update: toxcore-0.2.13-1.fc34

Tox is a peer to peer serverless instant messenger aimed at making security and privacy easy to obtain for regular users. It uses NaCl for its encryption and authentication...

Fedora: Security Advisory for toxcore (FEDORA-2021-8026e9b394)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-21980

creationtimestamp| type| source ---|---|--- 2021-11-24 20:27:05+00:00| seen| https://t.me/cibsecurity/32968 2021-11-25 06:14:19+00:00| seen| https://t.me/thehackernews/1679 2021-11-25 12:10:30+00:00| seen| https://t.me/truesecator/2371 2021-11-25 14:39:49+00:00| seen| https://t.me/NeKaspersky/147...