CVE-2023-28316

A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled...

Information disclosure

A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled...

Arbitrary file deletion

A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...

Buffer overflow

A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order...

PT-2023-21644 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: rocket.chat affected versions not specified Description: A security issue has been found in the implementation of 2FA on the rocket.chat platform. When 2FA is activated, other active sessions are not invalidated. This could allow an attacker ...

CVE-2023-28316

A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled...

Rocket.Chat 授权问题漏洞

Rocket.Chat is an open source team chat software. Rocket.Chat suffers from an authorization issue vulnerability. An attacker could use this vulnerability to bypass authentication and delete user messages...

PT-2023-21646 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat affected versions not specified Description: A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message KeepHistory or Message ShowDeletedStatus server configuration. This allows use...

CVE-2023-28318

A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...

CVE-2023-28316

Rocket.Chat 2FA bypass: enabling 2FA does not invalidate other active sessions, potentially allowing continued access to a compromised account. No patch version or explicit fix details are provided across the connected sources; monitor for updates (no public remediation confirmed).

CVE-2023-28318

A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...

CVE-2023-28318

CVE-2023-28318 affects Rocket.Chat. The vulnerability allows hiding messages and deletion notices regardless of Message_KeepHistory or Message_ShowDeletedStatus server configuration, bypassing intended deletion behavior. The core issue is an authorization/visibility flaw in Rocket.Chat that lets ...

Rocket.Chat 授权问题漏洞

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat. An attacker exploited the vulnerability to maintain access to an infected account...

CVE-2023-28317

CVE-2023-28317 affects Rocket.Chat. Editing a message changes the original timestamp, causing the UI to display messages in an incorrect order. The available documents confirm the affected software and the vulnerable behavior (timestamp manipulation on edits) but do not provide explicit exploitat...

Rocket.Chat 授权问题漏洞

Rocket.Chat is an open source team chat software. Rocket.Chat suffers from an authorization issue vulnerability that stems from the fact that editing a message can change the original timestamp, causing the UI to display the messages in the wrong order. An attacker could use this vulnerability to...

CVE-2023-28317

A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order...

CVE-2023-28316

A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled...

CVE-2023-28317

A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order...

Rocket.Chat: Rocket.Chat Desktop client fails to open browser on 3rd party external actions from PDF documents

A persistent Cross-Site Scripting XSS vulnerability was identified in the Rocket.Chat Electron desktop application affecting versions 6.3.4 and older. The vulnerability could be exploited through the upload and subsequent user interaction with files containing specially crafted links...

Rocket.Chat: Unauthenticated full-read SSRF via Twilio integration

A Server-Side Request Forgery SSRF vulnerability was discovered in the Twilio webhook endpoint of Rocket.Chat before version 6.10.1. The vulnerability allowed unauthenticated full-read access...