Zulip server 安全漏洞

Zulip server is an open source team chat application from Zulip, Inc. in the United States. A security vulnerability exists in Zulip server versions prior to 10.0, which stems from a data export feature that discloses private data, including user agent types and private channel subject headings...

CVE-2025-27149: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries E.g.,...

SUSE CVE-2025-27715

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

SUSE CVE-2025-27933

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public...

SUSE CVE-2025-30179

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries...

CVE-2024-36827

creationtimestamp| type| source ---|---|--- 2025-03-28 19:29:14+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9443...

CVE-2025-25100

creationtimestamp| type| source ---|---|--- 2025-03-28 17:28:51+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9409...

CVE-2025-31444

creationtimestamp| type| source ---|---|--- 2025-03-28 12:27:44+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9329...

CVE-2025-31435

creationtimestamp| type| source ---|---|--- 2025-03-28 12:27:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9323...

BIT-MATTERMOST-2025-27715

Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them...

BIT-MATTERMOST-2025-27933

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public...

SUSE CVE-2022-49740

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads This patch fixes slab-out-of-bounds reads in brcmfmac that occur in brcmfconstructchaninfo and brcmfenablebw402g when the count value of channel...

SUSE CVE-2022-49753

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix double increment of clientcount in dmachanget The first time dmachanget is called for a channel the channel clientcount is incorrectly incremented twice for public channels, first in balancerefcount, and again prio...

Mattermost Server 9.11.x < 9.11.9 (MMSA-2024-00409)

The version of Mattermost Server installed on the remote host is prior to 9.11.9. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00409 advisory. - Mattermost versions 9.11.x = 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel...

Mattermost Server 9.11.x < 9.11.9 / 10.3.x < 10.3.4 / 10.4.x < 10.4.3 (MMSA-2025-00418)

The version of Mattermost Server installed on the remote host is prior to 9.11.9, 10.3.4, or 10.4.3. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00418 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to fail to enforce channel...

CVE-2024-35362

creationtimestamp| type| source ---|---|--- 2025-03-27 21:27:59+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9230...

CVE-2024-30614

creationtimestamp| type| source ---|---|--- 2025-03-27 20:27:22+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9204...

CVE-2023-49234

creationtimestamp| type| source ---|---|--- 2025-03-27 18:26:46+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9170...

CVE-2023-53024

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca "bpf: Fix leakage due to insufficient speculative store bypass mitigation" inserts lfence instructions after 1...

CVE-2022-49740

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads This patch fixes slab-out-of-bounds reads in brcmfmac that occur in brcmfconstructchaninfo and brcmfenablebw402g when the count value of channel...