CVE-2023-23917

A prototype pollution vulnerability exists in Rocket.Chat server 5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may...

Code injection

A prototype pollution vulnerability exists in Rocket.Chat server 5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may...

CVE-2023-23917

A prototype pollution vulnerability exists in Rocket.Chat server 5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may...

Rocket.Chat 安全漏洞

Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat versions prior to 5.2.0, which stems from the presence of a prototype contamination vulnerability that can be exploited by an attacker to perform an RCE under the administrator account...

CVE-2023-23917

A prototype pollution vulnerability exists in Rocket.Chat server 5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may...

CVE-2023-23917

CVE-2023-23917 concerns a prototype pollution vulnerability in Rocket.Chat server versions prior to 5.2.0 that could enable remote code execution under an admin account. Multiple connected sources concur that an attacker could exploit this to gain admin access in cloud deployments and that the is...

Rocket.Chat: Reflected Cross-Site Scripting(CVE-2022-32770 )

Vulnerability description not provided...

Rocket.Chat Command Injection Vulnerability

Rocket.Chat is an open source team chat software. A command injection vulnerability exists in versions of Rocket.Chat prior to 3.8.14. The vulnerability stems from a failure of a network system or product to properly filter special characters, commands, etc. during user input to construct and...

CVE-2022-44567

A command injection vulnerability exists in Rocket.Chat-Desktop 3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video...

Command injection

A command injection vulnerability exists in Rocket.Chat-Desktop 3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video...

CVE-2022-44567

A command injection vulnerability exists in Rocket.Chat-Desktop 3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video...

CVE-2022-44567

Summary: CVE-2022-44567 affects Rocket.Chat-Desktop

Rocket.Chat 操作系统命令注入漏洞

Rocket.Chat is an open source team chat software. A command injection vulnerability exists in versions of Rocket.Chat prior to 3.8.14. The vulnerability stems from a failure of a network system or product to properly filter special characters, commands, etc. during user input to construct and...

Rocket.Chat: Cross-Site-Scripting in "Search Messages"

Vulnerability description not provided...

Rocket.Chat: Insecure use of shell.openExternal() leads to RCE in Rocket.Chat-Desktop

Rocket.Chat-Desktop passes the parameter url of openInternalVideoChatWindow to shell.openExternal, which may lead to remote code execution internalVideoChatWindow.tsL17. To exploit the vulnerability, the internal video chat window must be disabled or a Mac App Store build must be used...

Rocket.Chat: NoSQL injection in listEmojiCustom method call

Vulnerability description not provided...

Rocket.Chat: Low authorization level at server side API operation e2e.updateGroupKey, let an attacker break the E2E architecture.

The E2E encryption feature in open.rocket.chat server had a vulnerability that allowed an attacker to break the encryption of a secure chat room. The vulnerability was caused by a low authorization level at the server-side API operation e2e.updateGroupKey, which allowed an attacker to insert or...

Rocket.Chat getRoomRoles Meteor Information Disclosure Vulnerability

Rocket.Chat is an open source team chat software. An information disclosure vulnerability exists in Rocket.Chat versions prior to 4.7.5, 4.8.0 and later, and prior to 4.8.2, which stems from a lack of ACL checking in its getRoomRoles Meteor method, and can be exploited by an attacker to cause a...

Rocket.Chat Input Validation Error Vulnerability

Rocket.Chat is an open source team chat software. Rocket.Chat suffers from an input validation error vulnerability that stems from a failure to type validate input data in the getUsersOfRoom Meteor server method. An authenticated attacker could use this vulnerability to enumerate existing rooms a...

Rocket.Chat Information Disclosure Vulnerability (CNVD-2022-69164)

Rocket.Chat is an open source team chat software. Rocket.Chat suffers from an information disclosure vulnerability that stems from the presence of a clear-text transfer of sensitive information related to an oauth token, causing the oauth token to be leaked in the product. An attacker could explo...