254 matches found
Code injection
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value...
Design/Logic Flaw
Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...
CVE-2020-15070
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value...
CVE-2020-12759
CVE-2020-12759 affects Zulip Server prior to 2.1.5, with a reflected XSS vulnerability via the Dropbox webhook. Public records across NVD/Red Hat OSV/CVE entries confirm the issue in Zulip Server before 2.1.5 and indicate the root cause as unsafe handling of the webhook payload leading to cross-s...
CVE-2020-12759
Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...
CVE-2020-14194
CVE-2020-14194 affects Zulip Server prior to 2.1.5. The issue is a reverse tabnapping vulnerability triggered by a topic header link, enabling tabnabbing conditions in the Zulip web UI. Exploitation details are not provided beyond the reverse tabnapping description in the connected documents; no ...
CVE-2020-14194
Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...
CVE-2020-14215
CVE-2020-14215 affects Zulip Server up to version 2.1.4 (fixed in 2.1.5). Root cause: the 0198_preregistrationuser_invited_as logic adds the administrator role to invite objects, enabling insufficient access control. Impact: potential elevation of privileges via invitations, with impact to confid...
CVE-2020-14215
Zulip Server before 2.1.5 has Incorrect Access Control because 0198preregistrationuserinvitedas adds the administrator role to invitations...
CVE-2020-15070
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value...
CVE-2020-15070
Zulip Server 2.x before 2.1.7 is affected by an eval-injection vulnerability that an attacker with privilege and access to write to the PostgreSQL database can exploit by crafting a custom profile field value. The root cause is the ability to inject and evaluate code via a crafted value stored in...
Zulip Server eval injection vulnerability
Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. Zulip Server suffers from an eval injection vulnerability. An attacker who can write directly to the postgres...
Zulip Server Cross-Site Scripting Vulnerability (CNVD-2020-49009)
Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. A reflective cross-site scripting vulnerability exists in Zulip Server versions prior to 2.1.5. An attacker ca...
Zulip Server Reverse Tag Kidnapping Vulnerability
Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. A reverse tag kidnapping vulnerability exists in Zulip Server versions prior to 2.1.5. An attacker can exploit...
Zulip Server Access Control Error Vulnerability
Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. An access control error vulnerability exists in Zulip Server versions prior to 2.1.5. The vulnerability stems...
The vulnerability of the “invite_by_admins_only” permission implementation in the Zulip Server group chat application allows a violator to gain unauthorized access to protected information.
The vulnerability of the “invitebyadminsonly” permission implementation in the Zulip Server group chat application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
Zulip server Markdown parser cross-site scripting vulnerability
Zulip server is an open source team chat application from Zulip Inc.Markdown parser is one of the Markdown markup language parser. A cross-site scripting vulnerability exists in the modallink function of Markdown parser in Zulip Server versions prior to 2.1.3. The vulnerability stems from a lack ...
Unspecified vulnerability in Zulip server (CNVD-2021-28745)
Zulip server is an open source team chat application from the American company Zulip. A security vulnerability exists in Zulip Server versions prior to 2.1.3. An attacker can exploit the vulnerability to reverse tag via the dropdown feature...
Zulip server cross-site scripting vulnerability (CNVD-2020-33258)
Zulip server is an open source team chat application from the American company Zulip. A cross-site scripting vulnerability exists in Zulip Server versions prior to 2.1.3. The vulnerability stems from the WEB application's lack of proper validation of client-side data. An attacker can exploit this...
