CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-13972
https://notcve.org/view.php?id=CVE-2020-13972
Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This is related to CVE-2019-16951. Enghouse Web Chat versión 6.2.284.34, permite un ataque de tipo XSS. Cuando uno ingresa su propio nombre de dominio en el parámetro WebServiceLocation, la respuesta de la petición POST es mostrada, y cualquier JavaScript devuelto desde el servidor externo es ejecutado en el navegador. • http://burninatorsec.blogspot.com/2020/09/cve-2020-13972-xss-via-ssrf-in.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2019-16951
https://notcve.org/view.php?id=CVE-2019-16951
A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribute with one's own domain name. When the product calls this domain after the POST request is sent, it retrieves an attacker's data and displays it. Also worth mentioning is the amount of information sent in the request from this product to the attacker: it reveals information the public should not have. This includes pathnames and internal ip addresses. • https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2019-16950
https://notcve.org/view.php?id=CVE-2019-16950
An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request allows for insertion of user-supplied JavaScript. Se descubrió un problema de tipo XSS en Enghouse Web Chat versiones 6.1.300.31 y 6.2.284.34. El parámetro QueueName de una petición GET permite la inserción de JavaScript suministrado por el usuario. • https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2019-16949
https://notcve.org/view.php?id=CVE-2019-16949
An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their chat log to an email address specified at the beginning of the chat (where the user enters in their name and e-mail address). This POST request can be modified to change the message as well as the end recipient of the message. The e-mail address will have the same domain name and user as the product allotted. This can be used in phishing campaigns against users on the same domain. • https://mjlanders.com/2019/11/07/multiple-vulnerabilities-found-in-enghouse-zeacom-web-chat • CWE-20: Improper Input Validation •