Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
19 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhcweb/modules/lhfaq/faqweight.php.
Recommended action: Upgrade to 4.29 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. Attacker can execute malicious javascript on application.
Recommended action: Upgrade to 3.99 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SSRF filter bypass port 80, 433 in LiveHelperChat prior to v3.67. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
Recommended action: Upgrade to 3.67 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The secrethash, which the application relies for multiple security measures, can be brute-forced. The hash is quite small, with only 10 characters of only hexadecimal, making 16^10 possilibities ( 1.099.511.627.776 ). The SHA1 of the secret can be obtained via a captcha string and brute-forced offline with an GPU.
Recommended action: Upgrade to 3.96 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Live Helper Chat provides live support for your website. Loose comparison causes IDOR on multiple endpoints in LiveHelperChat prior to 3.96. There is a fix released in versions 3.96 and 3.97. Currently, there is no known workaround.
Recommended action: Upgrade to 3.96 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Recommended action: Upgrade to 3.93 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
LiveHelperChat prior to version 3.93 is vulnerable to cross-site scripting.
Recommended action: Upgrade to 3.93 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
LiveHelperChat (remdex/livehelperchat in Packagist) has a stored Cross-site Scripting (XSS) vulnerability prior to version 3.93.
Recommended action: Upgrade to 3.93 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
LiveHelperChat prior to version 3.93 contains a cross-site scripting vulnerability.
Recommended action: Upgrade to 3.93 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored XSS is found in SettingsLive help configurationDepartments-Departments groups-edit When a user creates a new webhook under the NAME field and puts a payload {{constructor.constructor('alert(1)')()}}, the input gets stored, at user edit groupname , the payload gets executed.
Recommended action: Upgrade to 3.93 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored XSS is found in SettingsLive help configurationPersonal Themestatic content. Under the NAME field put a payload {{constructor.constructor('alert(1)')()}} while creating content, and you will see that the input gets stored, and every time the user visits, the payload gets executed.
Recommended action: Upgrade to 3.93 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored XSS attacks exist in new the form creation flow. New forms can be given a title which will render javascript.
Recommended action: Upgrade to 3.93 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
LiveHelperChat is vulnerable to Stored XSS at the Name field in the Admin themes of System configuration.
Recommended action: Upgrade to 3.93 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Recommended action: Upgrade to 3.92 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A CSRF issue is found in the audit configuration under settings. It was found that no CSRF token validation is getting done on the server-side. If we remove the CSRF token and keep the CSRF token field empty, the action is getting performed.
Recommended action: Upgrade to 3.92 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information. There is an observable discrepancy between errors generated for users that exist and those that do not.
Recommended action: Upgrade to 3.91 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
Recommended action: Upgrade to 3.92 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Recommended action: Upgrade to 3.91 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Recommended action: Upgrade to 3.91 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.