Vulnerabilities

TI-2020-12560 CVE-2020-15948 · GHSA-hcff-f49j-c4pq

eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.

LOW 29

eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00912 Published 2021-07-28 No fix listed CWE-79

TI-2019-12776 CVE-2019-17123 · GHSA-pmmq-6pp3-rf2g

The eGain Web Email API 11+ allows spoofed messages because the fromName and message…

LOW 35

The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields (to /system/ws/v11/ss/email) are mishandled, as demonstrated by fromName header injection with a %0a or %0d character.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00984 Published 2019-12-13 No fix listed CWE-74

TI-2019-10425 CVE-2019-13976 · GHSA-8j8r-4m43-6442

eGain Chat 15.0.3 allows unrestricted file upload.

MEDIUM 46

eGain Chat 15.0.3 allows unrestricted file upload.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01736 Published 2019-09-04 No fix listed CWE-434

TI-2019-10424 CVE-2019-13975 · GHSA-pmv2-xr2g-m6j5

eGain Chat 15.0.3 allows HTML Injection.

LOW 29

eGain Chat 15.0.3 allows HTML Injection.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00857 Published 2019-09-04 No fix listed CWE-79

Vulnerabilities

Filters

eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.

The eGain Web Email API 11+ allows spoofed messages because the fromName and message…

eGain Chat 15.0.3 allows unrestricted file upload.

eGain Chat 15.0.3 allows HTML Injection.