Enghouse

Web Chat

5 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2020-13972

Exploit
  • EPSS 0.33%
  • Veröffentlicht 03.09.2020 15:15:11
  • Zuletzt bearbeitet 21.11.2024 05:02:16

Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This...

6.1

CVE-2019-16950

Exploit
  • EPSS 0.33%
  • Veröffentlicht 13.11.2019 19:15:12
  • Zuletzt bearbeitet 21.11.2024 04:31:24

An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript.

5.3

CVE-2019-16951

Exploit
  • EPSS 0.36%
  • Veröffentlicht 13.11.2019 19:15:12
  • Zuletzt bearbeitet 21.11.2024 04:31:24

A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data a...

6.5

CVE-2019-16949

Exploit
  • EPSS 0.28%
  • Veröffentlicht 13.11.2019 18:15:10
  • Zuletzt bearbeitet 21.11.2024 04:31:24

An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat (where the user enters in their name and e-mail address). This P...

9.8

CVE-2019-16948

Exploit
  • EPSS 0.36%
  • Veröffentlicht 13.11.2019 17:15:13
  • Zuletzt bearbeitet 21.11.2024 04:31:23

An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at WebServiceLocation=http://localhost:8085/UCWebServices/ with a range of ports to determine what is visible on the internal network (...