Sql injection

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...

Information disclosure

An information disclosure vulnerability exists in Rocket.Chat v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.findqueryFromClientSide. This means virtually any authenticated user can access any data except password hashes of any user authenticat...

Information disclosure

An information disclosure vulnerability exists in Rocket.Chat v5, v4.8.2 and v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs...

Authentication flaw

An improper authentication vulnerability exists in Rocket.Chat Mobile App 4.14.1.22788 that allowed an attacker with physical access to a mobile device to bypass local authentication PIN code...

CVE-2022-32219

An information disclosure vulnerability exists in Rocket.Chat v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.findqueryFromClientSide. This means virtually any authenticated user can access any data except password hashes of any user authenticat...

CVE-2022-32220

An information disclosure vulnerability exists in Rocket.Chat v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room...

CVE-2022-32219

CVE-2022-32219 describes an information disclosure in Rocket.Chat prior to 4.7.5 where the REST endpoint users.list accepts a query parameter from JSON and executes it via Users.find(queryFromClientSide) . This allows virtually any authenticated user to access data from the users collection (exce...

CVE-2022-32211

Rocket.Chat is affected by a SQL injection vulnerability (CVE-2022-32211) that can enable an attacker to retrieve a reset password token or a 2fa secret. Affected versions: prior to 3.18.6, prior to 4.4.4, and prior to 4.7.3. Root cause: insufficient input validation/external SQL handling in the ...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-30124

An improper authentication vulnerability exists in Rocket.Chat Mobile App 4.14.1.22788 that allowed an attacker with physical access to a mobile device to bypass local authentication PIN code...

CVE-2022-32219

An information disclosure vulnerability exists in Rocket.Chat v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.findqueryFromClientSide. This means virtually any authenticated user can access any data except password hashes of any user authenticat...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-30124

An improper authentication vulnerability exists in Rocket.Chat Mobile App 4.14.1.22788 that allowed an attacker with physical access to a mobile device to bypass local authentication PIN code...

CVE-2022-32220

Rocket.Chat prior to v5 is impacted by an information-disclosure vulnerability in the getUserMentionsByChannel Meteor server method, which returns messages from private channels and DMs regardless of the user’s room access. Exploitation lets an authenticated user obtain sensitive messages they sh...

CVE-2022-32211

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-32211

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...

CVE-2022-32217

Summary: CVE-2022-32217 affects Rocket.Chat prior to v4.6.4, where an OAuth token is leaked in plaintext in logs, leading to potential information disclosure. What’s affected: Rocket.Chat versions before 4.6.4; the issue is a cleartext storage/disclosure of sensitive OAuth tokens in logs. Root ca...

CVE-2022-32220

An information disclosure vulnerability exists in Rocket.Chat v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room...

CVE-2022-32211

A SQL injection vulnerability exists in Rocket.Chat v3.18.6, v4.4.4 and v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2fa secret...