667 matches found
Cross site scripting
Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting XSS vulnerability via the drag & drop functionality in message boxes...
Rocket.Chat 跨站脚本漏洞
Rocket.Chat is an open source team chat software. A cross-site scripting vulnerability exists in Rocket.Chat server versions prior to 3.9.0, which stems from the drag-and-drop functionality being susceptible to XSS attacks. No details of the vulnerability are available at this time...
Rocket.Chat server 跨站脚本漏洞
Rocket.Chat is an open source team chat software. A cross-site scripting vulnerability exists in Rocket.Chat server versions prior to 3.9.2, which stems from the value parameter. No details of the vulnerability are available at this time...
CVE-2020-8292
CVE-2020-8292 affects Rocket.Chat server prior to 3.9.0, vulnerable to a self‑XSS via the drag-and-drop in message boxes. The issue is described across multiple sources as a client‑side XSS that can be triggered by a user action, with potential for session-related impact (per HackerOne report) if...
CVE-2020-8292
Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting XSS vulnerability via the drag & drop functionality in message boxes...
CVE-2020-8288
The specializedRendering function in Rocket.Chat server before 3.9.2 allows a cross-site scripting XSS vulnerability by way of the value parameter...
CVE-2020-8288
Summary: CVE-2020-8288 affects Rocket.Chat server prior to 3.9.2 where the specializedRendering function processes the value parameter, enabling cross-site scripting (XSS). Affected software: Rocket.Chat server (version
CVE-2020-28208
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1...
CVE-2020-28208
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1...
Design/Logic Flaw
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1...
CVE-2020-28208
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1...
CVE-2020-28208
Rocket.Chat up to version 3.9.1 is affected by an information-disclosure vulnerability in the password-reset function that allows an attacker to enumerate registered email addresses. The root cause is information exposure via the reset workflow, enabling potential access to sensitive information....
Rocket.Chat 3.7.1 Email Address Enumeration
Trovent Security Advisory 2010-01 Email address enumeration in reset password Overview Advisory ID: TRSA-2010-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2010-01 Affected product: Web application Rocket.Chat Affected version: = 3.7.1 Vendor:...
Rocket.Chat Security Vulnerability
Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat 3.7.1, which can be exploited by an attacker to perform e-mail address enumeration...
Rocket.Chat: Registration bypass with leaked Invite Token
The Rocket.Chat API route 'validateInviteToken' was vulnerable to a registration bypass attack. The route allowed unauthenticated users to guess valid invite tokens by sending a crafted JSON payload with a regular expression. Once a valid token was obtained, the user could access private channels...
Rocket.Chat Authorization Issues Vulnerability
Rocket.Chat is an open source team chat software. A security vulnerability exists in Rocket.Chat that stems from incorrectly handling SAML logins. No details of the vulnerability are provided at this time...
CVE-2020-29594
Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login...
CVE-2020-29594
Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login...