cryptocat vulnerabilities and fixes

Recent CVEs affecting cryptocat, with upgrade or downgrade steps. 17 tracked.

cryptocat has 17 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 14. Most recent: 2019-11-14. Highest priority: CVE-2013-4103 (score 68/100).

• CVE-2013-4110 MEDIUM 5.3 MITIGATE Cryptocat has an Unspecified Chat Participant User List Disclosure
• CVE-2013-4109 MEDIUM 6.1 DOWNGRADE An unspecified cross-site scripting (XSS) vulnerability exists in Cryptocat Message Handling 1.1.165.
• CVE-2013-4108 CRITICAL 9.8 DOWNGRADE Multiple unspecified vulnerabilities in Cryptocat Project Cryptocat 2.0.18 have unknown impact and attack vect
• CVE-2013-4107 MEDIUM 6.1 UPGRADE Cryptocat before 2.0.22: cryptocat.js handlePresence() has cross site scripting
• CVE-2013-4106 MEDIUM 6.1 UPGRADE A Cross-site scripting (XSS) vulnerability exists in Conversation Overview Nickname in Cryptocat before 2.0.22
• CVE-2013-4105 HIGH 7.5 UPGRADE Cryptocat before 2.0.22 has Multiparty Encryption Scheme Information Disclosure
• CVE-2013-4104 HIGH 7.5 UPGRADE Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol
• CVE-2013-4103 CRITICAL 9.8 UPGRADE Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input
• CVE-2013-4102 CRITICAL 9.1 UPGRADE Cryptocat before 2.0.22 strophe.js Math.random() Random Number Generator Weakness
• CVE-2013-4101 MEDIUM 5.3 UPGRADE Cryptocat before 2.0.22 Link Markup Decorator HTML Handling Weakness
• CVE-2013-4100 HIGH 7.5 UPGRADE Cryptocat before 2.0.22 has Remote Denial of Service via username
• CVE-2013-2262 HIGH 7.5 UPGRADE Cryptocat strophe.js before 2.0.22 has information disclosure
• CVE-2013-2261 HIGH 7.5 UPGRADE Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure
• CVE-2013-2260 CRITICAL 9.8 UPGRADE Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness
• CVE-2013-2259 CRITICAL 9.8 UPGRADE Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview
• CVE-2013-2258 MEDIUM 5.3 UPGRADE Cryptocat before 2.0.22 has Nickname User Impersonation
• CVE-2013-2257 HIGH 7.5 UPGRADE Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness

FAQ

How do I fix cryptocat vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is cryptocat being exploited right now?

None of the tracked cryptocat CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which cryptocat CVE should I patch first?

CVE-2013-4103 currently ranks highest (68/100): Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input.

RSS feed for cryptocat · ← Back to latest CVEs