Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,730 results · page 25 of 35
Feb 6, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0502 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0395 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0394 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0387 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0370 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0375 · Other software · livehelperchat · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-0374 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.CVE-2022-0266 · Other software · livehelperchat · reported by security@huntr.devMedium 6.6
Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21694 · Other software · onionshare · reported by GitHubLow 3.7
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. The website mode of the onionshare allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21692 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions anyone with access to the chat environment can write messages disguised as another chat participant.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21690 · Other software · onionshare · reported by GitHubHigh 8.7
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions The path parameter of the requested URL is not sanitized before being passed to the QT frontend. This path is used in all components for displaying the server access history. This leads to a rendered HTML4 Subset (QT RichText editor) in the Onionshare frontend.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21695 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21693 · Other software · onionshare · reported by GitHubMedium 6.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions an adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced. This can be mitigated by usage of the flatpak release.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21691 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21689 · Other software · onionshare · reported by GitHubHigh 7.5
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions the receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script. An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21688 · Other software · onionshare · reported by GitHubHigh 7.5
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Affected versions of the desktop application were found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is required. An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack, which quickly results in out-of-memory for the server. This requires the desktop application with rendered history, therefore the impact is only elevated. This issue has been patched in version 2.5.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network.CVE-2022-21696 · Other software · onionshare · reported by GitHubMedium 4.3
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
- Product
- onionshare
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Crisp Live Chat: Cross-Site Request ForgeryCVE-2021-43353 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.
- Product
- Crisp Live Chat
- Affected
- up to 0.31
- What to do
- Affects up to 0.31. Update Crisp Live Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jan 18, 2022Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.CVE-2022-0245 · Other software · livehelperchat · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2022-0253 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-0226 · Other software · livehelperchat · reported by security@huntr.devMedium 4.3
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2022-0231 · Other software · livehelperchat · reported by security@huntr.devMedium 6.5
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2022Convos is an open source multi-user chat that runs in a web browser.CVE-2022-21650 · Other software · convos-chat · reported by GitHubHigh 7.6
Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.
- Product
- convos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.pocas.krgithub.com
Jan 4, 2022Convos is an open source multi-user chat that runs in a web browser.CVE-2022-21649 · Other software · convos-chat · reported by GitHubHigh 7.6
Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "<" or ">" but escaping for double quotes does not exist. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.
- Product
- convos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.pocas.krgithub.com
Jan 4, 2022livehelperchat is vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2022-0083 · Other software · livehelperchat · reported by security@huntr.devMedium 5.3
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2022Chaty: And Chaty Pro WordPress plugin before 2CVE-2021-25016 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting
- Product
- Chaty
- Fixed in
- 2.8.3
- What to do
- Update Chaty to 2.8.3 or newer.
Dec 29, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4176 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4175 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4179 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2021livehelperchat is vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2021-4177 · Other software · livehelperchat · reported by security@huntr.devMedium 5.3
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4169 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2021Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file typCVE-2021-44164 · Other software · Chain Sea Information Integration Co., Ltd · reported by twcert@cert.org.twCritical 9.8
Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service.
- Product
- ai chatbot system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 19, 2021Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for CVE-2021-44163 · Other software · Chain Sea Information Integration Co., Ltd · reported by twcert@cert.org.twMedium 6.1
Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for XSS (reflected Cross-site scripting) attack without authentication.
- Product
- ai chatbot system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 19, 2021Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability.CVE-2021-44162 · Other software · Chain Sea Information Integration Co., Ltd · reported by twcert@cert.org.twHigh 7.5
Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in URL parameters, which allows a remote attacker to download arbitrary system files without authentication.
- Product
- ai chatbot system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Dec 18, 2021livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4131 · Other software · livehelperchat · reported by security@huntr.devHigh 8.8
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021A Stored Cross Site Scripting (XSS) issue exists in Convos-Chat before 6.32.CVE-2021-42584 · Other software · Convos · reported by MITREMedium 5.4
A Stored Cross Site Scripting (XSS) issue exists in Convos-Chat before 6.32.
- Product
- Convos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev696.github.iogithub.com
Dec 17, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4132 · Other software · livehelperchat · reported by security@huntr.devMedium 5.4
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.CVE-2021-43678 · Other software · Wechat-php-sdk Project · reported by MITREMedium 6.1
Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.
- Product
- Wechat-php-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2021livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4123 · Other software · livehelperchat · reported by security@huntr.devMedium 6.5
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021Owncast is an open source, self-hosted live video streaming and chat server.CVE-2021-39183 · Other software · owncast · reported by GitHubHigh 8.2
Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.
- Product
- owncast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\CVE-2021-34425 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 4.7
The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerability in the chat\'s "link preview" functionality. In versions prior to 5.7.3, if a user were to enable the chat\'s "link preview" feature, a malicious actor could trick the user into potentially sending arbitrary HTTP GET requests to URLs that the actor cannot reach directly.
- Product
- Zoom Client for Meetings for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Dec 8, 2021livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-4050 · Other software · livehelperchat · reported by security@huntr.devMedium 6.1
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2021livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-4049 · Other software · livehelperchat · reported by security@huntr.devMedium 6.5
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
- Product
- livehelperchat/livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2021Tawk.To Live Chat: Does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actionsCVE-2021-24914 · WordPress plugins & themes · reported by WPScanHigh 8
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.
- Product
- Tawk.To Live Chat
- Fixed in
- 0.6.0
- What to do
- Update Tawk.To Live Chat to 0.6.0 or newer.
Dec 1, 2021Zulip is an open source group chat application that combines real-time chat with threaded conversations.CVE-2021-43791 · Other software · zulip · reported by GitHubMedium 6.5
Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a user to the check_prereg_key_and_redirect endpoint, before getting redirected to POST to /accounts/register/. The problem was that validation was happening in the check_prereg_key_and_redirect part and not in /accounts/register/ - meaning that one could submit an expired confirmation key and be able to register. The issue is fixed in Zulip 4.8. There are no known workarounds and users are advised to upgrade as soon as possible.
- Product
- zulip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2021OX App Suite 7.10.5 allows XSS via an OX Chat system message.CVE-2021-33495 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite 7.10.5 allows XSS via an OX Chat system message.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopen-xchange.com
Nov 22, 2021OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.CVE-2021-33494 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopen-xchange.com
Nov 22, 2021OX App Suite 7.10.5 allows XSS via an OX Chat room name.CVE-2021-33492 · Other software · Open-xchange · reported by MITREMedium 6.1
OX App Suite 7.10.5 allows XSS via an OX Chat room name.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopen-xchange.com
Nov 22, 2021chat in OX App Suite 7.10.5 has Improper Input Validation.CVE-2021-33488 · Other software · Open-xchange · reported by MITREMedium 6.1
chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook.
- Product
- OX App Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 1, 2021BP Better Messages: Does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chatCVE-2021-24809 · WordPress plugins & themes · reported by WPScanHigh 8.8
The BP Better Messages WordPress plugin before 1.9.9.41 does not check for CSRF in multiple of its AJAX actions: bp_better_messages_leave_chat, bp_better_messages_join_chat, bp_messages_leave_thread, bp_messages_mute_thread, bp_messages_unmute_thread, bp_better_messages_add_user_to_thread, bp_better_messages_exclude_user_from_thread. This could allow attackers to make logged in users do unwanted actions
- Product
- BP Better Messages
- Fixed in
- 1.9.9.41
- What to do
- Update BP Better Messages to 1.9.9.41 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.