Efs Software Easy Chat Server vulnerabilities

CVE-2004-2466 [MEDIUM] CWE-119 CVE-2004-2466: chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) chat.ghp in Easy Chat Server 1.2 allows remote attackers to cause a denial of service (server crash) via a long username parameter, possibly due to a buffer overflow. NOTE: it was later reported that 2.2 is also affected.

CVE-2023-4494 [CRITICAL] CWE-119 CVE-2023-4494: Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an Stack-based buffer overflow vulnerability in Easy Chat Server 3.1 version. An attacker could send an excessively long username string to the register.ghp file asking for the name via a GET request resulting in arbitrary code execution on the remote machine.

CVE-2006-6933 [HIGH] CVE-2006-6933: Easy Chat Server 2.1 stores sensitive information under the web root with insufficient access contro Easy Chat Server 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download certain files via direct requests to files such as (1) ServerKey.pem and (2) AcceptIP.txt. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

CVE-2023-4497 [MEDIUM] CWE-79 CVE-2023-4497: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled input Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Icon parameter. The XSS is loaded from /users.ghp.

CVE-2023-4495 [MEDIUM] CWE-79 CVE-2023-4495: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled input Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Resume parameter. The XSS is loaded from /register.ghp.

CVE-2023-4496 [MEDIUM] CWE-79 CVE-2023-4496: Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled input Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /body2.ghp (POST method), in the mtowho parameter.

CVE-2004-2467 [MEDIUM] CVE-2004-2467: chat.ghp in Easy Chat Server 1.2 allows remote attackers to add a large number of fake users, then e chat.ghp in Easy Chat Server 1.2 allows remote attackers to add a large number of fake users, then eventually cause a denial of service (server crash).

CVE-2004-2465 [MEDIUM] CVE-2004-2465: Cross-site scripting (XSS) vulnerability in chat.ghp in Easy Chat Server 1.2 allows remote attackers Cross-site scripting (XSS) vulnerability in chat.ghp in Easy Chat Server 1.2 allows remote attackers to inject arbitrary web script or HTML via the username parameter.