Xchat : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2013-7449	310			2016-04-21	2016-05-06	5.8	None	Remote	Medium	Not required	Partial	Partial	None
The ssl_do_connect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
2	CVE-2011-5129	119	2	DoS Exec Code Overflow	2012-08-30	2013-02-13	5.0	None	Remote	Low	Not required	None	None	Partial
Heap-based buffer overflow in XChat 2.8.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long response string.
3	CVE-2009-0315			Exec Code	2009-01-28	2009-03-06	6.9	Admin	Local	Medium	Not required	Complete	Complete	Complete
Untrusted search path vulnerability in the Python module in xchat allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
4	CVE-2008-2841	94		Exec Code	2008-06-24	2017-09-28	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
Argument injection vulnerability in XChat 2.8.7b and earlier on Windows, when Internet Explorer is used, allows remote attackers to execute arbitrary commands via the --command parameter in an ircs:// URI.
5	CVE-2006-4455			DoS	2006-08-30	2017-10-18	5.0	None	Remote	Low	Not required	None	None	Partial
DISPUTED Unspecified vulnerability in Xchat 2.6.7 and earlier allows remote attackers to cause a denial of service (crash) via unspecified vectors involving the PRIVMSG command. NOTE: the vendor has disputed this vulnerability, stating that it does not affect 2.6.7 "or any recent version".
6	CVE-2004-0409			Exec Code Overflow	2004-06-01	2017-10-10	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the Socks-5 proxy code for XChat 1.8.0 to 2.0.8, with socks5 traversal enabled, allows remote attackers to execute arbitrary code.
7	CVE-2003-1000			DoS	2004-01-05	2016-10-17	5.0	None	Remote	Low	Not required	None	None	Partial
xchat 2.0.6 allows remote attackers to cause a denial of service (crash) via a passive DCC request with an invalid ID number, which causes a null dereference.
8	CVE-2002-0382			Exec Code	2002-06-25	2016-10-17	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
XChat IRC client allows remote attackers to execute arbitrary commands via a /dns command on a host whose DNS reverse lookup contains shell metacharacters.
9	CVE-2002-0006			Exec Code	2002-06-25	2017-10-09	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
XChat 1.8.7 and earlier, including default configurations of 1.4.2 and 1.4.3, allows remote attackers to execute arbitrary IRC commands as other clients via encoded characters in a PRIVMSG command that calls CTCP PING, which expands the characters in the client response when the percascii variable is set.
10	CVE-2001-0792			Exec Code	2001-10-18	2017-10-09	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Format string vulnerability in XChat 1.2.x allows remote attackers to execute arbitrary code via a malformed nickname.
11	CVE-2000-0787			Exec Code	2000-10-20	2008-09-10	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
IRC Xchat client versions 1.4.2 and earlier allows remote attackers to execute arbitrary commands by encoding shell metacharacters into a URL which XChat uses to launch a web browser.

Total number of vulnerabilities : 11 Page : 1 (This Page)