An attacker was able to inject malformed characters in JSON to escape outside defined parameters and create custom JSON objects with custom data, resulting in Denial of Service across the site while rendering.

Inadequate HSTS implementation, allowing potential unencrypted connections. Missing secure flag for sensitive HTTP cookies.

An attacker was able to perform reflected cross site scripting by providing javascript in the chat window, causing the page to render the javascript in user context.

An attacker was able to inject malformed characters in JSON to escape outside defined parameters and create custom JSON objects with custom data, resulting in Denial of Service across the site while rendering.