Enghouse Systems Web Chat Input Validation Error Vulnerability

Enghouse Systems Web Chat is a web-based online chat application from Enghouse Systems Canada. An input validation error vulnerability exists in Enghouse Systems Web Chat versions 6.1.300.31 and 6.2.284.34. The vulnerability stems from the web system or product not properly validating input data...

Enghouse Systems Web Chat Information Disclosure Vulnerability

Enghouse Systems Web Chat is a web-based online chat application from Enghouse Systems Canada. An information disclosure vulnerability exists in Enghouse Systems Web Chat version 6.2.284.34. The vulnerability stems from an error in configuration or other errors in the operation of a networked...

Enghouse Systems Web Chat Cross-Site Scripting Vulnerability

Enghouse Systems Web Chat is a web-based online chat application from Enghouse Systems Canada. A cross-site scripting vulnerability exists in Enghouse Systems Web Chat versions 6.1.300.31 and 6.2.284.34. The vulnerability stems from the WEB application's lack of proper validation of client data. ...

Slack-Chat Information Disclosure Vulnerability

Slack-Chat is a jQuery based web chat application. Slack-Chat suffers from an information disclosure vulnerability. An attacker can exploit the vulnerability to obtain a large amount of information about a victim's availability channels, members, etc...

CVE-2019-16950

An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript...

CVE-2019-16950

An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript...

CVE-2019-16951

A remote file include RFI issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amou...

CVE-2019-16951

A remote file include RFI issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amou...

Cross site scripting

An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript...

Remote file inclusion

A remote file include RFI issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amou...

CVE-2019-16951

Enghouse Web Chat 6.2.284.34 is affected by a remote file include (RFI) vulnerability (CVE-2019-16951). The issue allows an attacker to substitute the localhost attribute with an attacker-controlled domain; after a POST, the product calls that domain and may return data that reveals sensitive inf...

CVE-2019-16951

A remote file include RFI issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amou...

CVE-2019-16949

An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat where the user enters in their name and e-mail address. This POST request can be modified to change the message...

CVE-2019-16949

An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat where the user enters in their name and e-mail address. This POST request can be modified to change the message...

Code injection

An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat where the user enters in their name and e-mail address. This POST request can be modified to change the message...

CVE-2019-16950

CVE-2019-16950 affects Enghouse Web Chat versions 6.1.300.31 and 6.2.284.34. The issue is an XSS where the QueueName parameter of a GET request allows insertion of user-supplied JavaScript due to insufficient input validation. Red Hat and CNVD entries corroborate a cross-site scripting vulnerabil...

CVE-2019-16950

An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript...

CVE-2019-16949

Enghouse Web Chat 6.1.300.31 and 6.2.284.34 contain an issue where a user can abuse a chat-log archive sending feature. A POST request at chat start allows altering the message and the end recipient’s address, which will share the log with an address having the same domain/user as the product all...

CVE-2019-16949

An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat where the user enters in their name and e-mail address. This POST request can be modified to change the message...

CVE-2019-16948

An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network as opposed to what general web traffic would see...