254 matches found
CVE-2022-31017 Expression Always True vulnerability in Zulip Server
Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the...
CVE-2022-31017 Expression Always True vulnerability in Zulip Server
Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the...
CVE-2022-23656
Zulip is an open source team chat app. The main development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several...
CVE-2022-23656 Cross-site scripting vulnerability in Zulip Server
Zulip is an open source team chat app. The main development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several...
CVE-2022-23656 Cross-site scripting vulnerability in Zulip Server
Zulip is an open source team chat app. The main development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several...
CVE-2022-23656 Cross-site scripting vulnerability in Zulip Server
Zulip is an open source team chat app. The main development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several...
Zulip server has an unspecified vulnerability (CNVD-2022-15523)
Zulip server is an open source team chat application from Zulip USA. zulip server has a security vulnerability that stems from the fact that zlip Server deployments that reside in multiple organizations are vulnerable to attacks where an invitation created in one organization possibly a role with...
Improper access control
Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation...
CVE-2022-21706 Multi-use invitations can grant access to other organizations in Zulip
Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation...
CVE-2022-21706 Multi-use invitations can grant access to other organizations in Zulip
Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation...
CVE-2022-21706
Zulip Server 2.0.0+ was vulnerable to insufficient access control via multi-use invitations in multi-org deployments: an invite from one organization could join another, bypassing domain restrictions and potentially granting elevated privileges. It is patched in release 4.10; upgrading to 4.10 fi...
Zulip server 安全漏洞
Zulip server is an open source team chat application from Zulip USA. zulip server has a security vulnerability that stems from the fact that zlip Server deployments that reside in multiple organizations are vulnerable to attacks where an invitation created in one organization possibly a role with...
PT-2022-15053 · Unknown · Zulip Server
Name of the Vulnerable Software and Affected Versions: Zulip Server versions 2.0.0 through 4.9 Description: Zulip is an open-source team collaboration tool with topic-based threading. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation creat...
Zulip server security feature issue vulnerability
Zulip server is an open source team chat application from the American company Zulip. A security signature issue vulnerability exists in Zulip Server versions prior to 4.9, which results from incorrect input validation. A remote attacker can exploit this vulnerability to send a crafted request an...
CVE-2021-43799
Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation until first reboot, or restart of RabbitMQ does not successfully limit the default ports which RabbitMQ opens; this...
Design/Logic Flaw
Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation until first reboot, or restart of RabbitMQ does not successfully limit the default ports which RabbitMQ opens; this...
CVE-2021-43799 RabbitMQ exposes ports with weak default secrets in Zulip Server
Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation until first reboot, or restart of RabbitMQ does not successfully limit the default ports which RabbitMQ opens; this...
CVE-2021-43799 RabbitMQ exposes ports with weak default secrets in Zulip Server
Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation until first reboot, or restart of RabbitMQ does not successfully limit the default ports which RabbitMQ opens; this...
CVE-2021-43799
Zulip Server before version 4.9 runs RabbitMQ for internal messaging, and at initial install may leave port 25672 open without strong protection. The RabbitMQ cookie is generated with a weak PRNG, yielding about 20 bits of entropy, enabling a remote attacker to brute-force the cookie if OS/networ...
Zulip Server 安全特征问题漏洞
Zulip server is an open source team chat application from the American company Zulip. A security signature issue vulnerability exists in Zulip Server versions prior to 4.9, which results from incorrect input validation. A remote attacker can exploit this vulnerability to send a crafted request an...