livezilla vulnerabilities and fixes

Recent CVEs affecting livezilla, with upgrade or downgrade steps. 19 tracked.

livezilla has 19 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 18. Most recent: 2020-03-09. Highest priority: CVE-2013-6225 (score 69/100).

• CVE-2020-9758 CRITICAL 9.6 UPGRADE An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk)
• CVE-2019-12964 MEDIUM 6.1 UPGRADE LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the ticket.php Subject.
• CVE-2019-12963 MEDIUM 6.1 UPGRADE LiveZilla Server before 8.0.1.1 is vulnerable to XSS in the chat.php Create Ticket Action.
• CVE-2019-12962 MEDIUM 6.1 UPGRADE LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header.
• CVE-2019-12961 HIGH 8.8 UPGRADE LiveZilla Server before 8.0.1.1 is vulnerable to CSV Injection in the Export Function.
• CVE-2019-12960 CRITICAL 9.8 UPGRADE LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the par
• CVE-2019-12940 MEDIUM 5.9 UPGRADE LiveZilla Server before 8.0.1.1 is vulnerable to Denial Of Service (memory consumption) in knowledgebase.php v
• CVE-2019-12939 CRITICAL 9.8 UPGRADE LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.
• CVE-2018-10810 MEDIUM 6.1 UPGRADE chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Acc
• CVE-2017-15869 MEDIUM 6.1 UPGRADE Cross-site scripting (XSS) vulnerability in knowledgebase.php in LiveZilla before 7.0.8.9 allows remote attack
• CVE-2013-7385 MEDIUM 6.8 UPGRADE LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code t
• CVE-2013-7034 HIGH 7.5 UPGRADE The setCookieValue function in _lib/functions.global.inc.php in LiveZilla before 5.1.2.1 allows remote attacke
• CVE-2013-7033 MEDIUM 4.3 UPGRADE LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by l
• CVE-2013-7032 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in the web based operator client in LiveZilla before 5.1.2
• CVE-2013-7003 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in LiveZilla before 5.1.2.0 allow remote attackers to inje
• CVE-2013-7002 MEDIUM 4.3 UPGRADE Cross-site scripting (XSS) vulnerability in mobile/php/translation/index.php in LiveZilla before 5.1.1.0 allow
• CVE-2013-6225 CRITICAL 9.8 DOWNGRADE LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability
• CVE-2013-6224 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in LiveZilla before 5.1.1.0 allow remote attackers to inje
• CVE-2013-6223 LOW 2.1 UPGRADE LiveZilla before 5.1.1.0 stores the admin Base64 encoded username and password in a 1click file, which allows

FAQ

How do I fix livezilla vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is livezilla being exploited right now?

None of the tracked livezilla CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which livezilla CVE should I patch first?

CVE-2013-6225 currently ranks highest (69/100): LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability.

RSS feed for livezilla · ← Back to latest CVEs