CVE-2020-27359

A cross-site scripting XSS issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a messag...

Cross site scripting

A cross-site scripting XSS issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a messag...

CVE-2020-27853

Wire before 2020-10-16 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a format string. This affects Wire AVS Audio, Video, and Signaling 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, an...

CVE-2020-27853

Wire before 2020-10-16 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a format string. This affects Wire AVS Audio, Video, and Signaling 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, an...

CVE-2020-27853

Wire before 2020-10-16 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a format string. This affects Wire AVS Audio, Video, and Signaling 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, an...

CVE-2020-27853

CVE-2020-27853 is a format-string vulnerability in Wire’s peerflow/sdp.c (sdp_media_set_lattr). It affects Wire AVS 5.3–6.x before 6.4 and Wire Secure Messenger apps on Android/iOS (before the listed versions). Remote attackers could cause a denial of service (crash) or execute arbitrary code; im...

Researchers: Instagram, LinkedIn Vulnerable to Preview-Link RCE Security Woes

UPDATE Link previews in popular chat apps on iOS and Android are a firehose of security and privacy issues, researchers have found. At risk are Facebook Messenger, LINE, Slack, Twitter Direct Messages, Zoom and many others. In the case of Instagram and LinkedIn, it’s even possible to execute remo...

WordPress Web Instant Messenger plugin <= 1.1.2 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability

Unauthenticated Persistent Cross-Site Scripting XSS vulnerability discovered by m0ze Ex.Mi in WordPress Web Instant Messenger plugin versions = 1.1.2. Solution 2021-03-19 - we were unable to find a patched version of this plugin. WordPress.org notice: "This plugin has been closed as of October 21...

The vulnerability of the eval function in the cd-messenger software lies in insufficient validation of input data, allowing a perpetrator to execute arbitrary code.

The vulnerability of the eval function in the cd-messenger software exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

File Upload Vulnerability in Big Ant Instant Messaging Backend

Big Ant Instant Messenger Soft is a powerful enterprise office communication software. A file upload vulnerability exists in the backend of BigAnt Instant Messenger, which can be exploited by attackers to gain server privileges...

ceph: secure mode of msgr2 breaks both confidentiality and integrity aspects for long-lived sessions

A nonce reuse vulnerability was discovered in the secure mode of the messenger v2 protocol, which can allow an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious...

Android Malware Bypasses 2FA And Targets Telegram, Gmail Passwords

Researchers have uncovered a threat group launching surveillance campaigns that target victims’ personal device data, browser credentials and Telegram messaging application files. One notable tool in the group’s arsenal is an Android malware that collects all two-factor authentication 2FA securit...

Fedora 32 : php-symfony4 (2020-16eb328853)

Version 4.4.13 2020-09-02 - security CVE-2020-15094 Remove headers with internal meaning from HttpClient responses mpdude - bug 38024 Console Fix undefined index for inconsistent command name definition chalasr - bug 38023 DI fix inlining of non-shared services nicolas-grekas - bug 38020...

CVE-2020-1487

An information disclosure vulnerability exists when Media Foundation improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system. To exploit this vulnerability, an attacker would have to log onto ...

CVE-2020-17476

Mibew Messenger before 3.2.7 allows XSS via a crafted user name...

CVE-2020-17476

Mibew Messenger before 3.2.7 allows XSS via a crafted user name...

Cross site scripting

Mibew Messenger before 3.2.7 allows XSS via a crafted user name...

CVE-2020-17476

The CVE-2020-17476 issue affects Mibew Messenger prior to 3.2.7, where an XSS vulnerability is exploitable via a crafted user name. The vulnerability is documented across multiple feeds (NVD, Red Hat security page, OSV, CVE listings). The likely remediation is upgrading to Mibew Messenger 3.2.7 o...

CVE-2020-17476

Mibew Messenger before 3.2.7 allows XSS via a crafted user name...

Nonce Reuse

ceph is vulnerable to nonce reuse in the secure mode of the messenger v2 protocol. It allows an attacker to forge auth tags and potentially manipulate the data by leveraging the reuse of a nonce in a session. Messages encrypted using a reused nonce value are susceptible to serious confidentiality...