CVE-2020-9445

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

CVE-2020-9444

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

CVE-2020-9445

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

CVE-2020-9444

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

CVE-2020-10935

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

Design/Logic Flaw

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

Design/Logic Flaw

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

Design/Logic Flaw

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

CVE-2020-9445

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

CVE-2020-9445

CVE-2020-9445 affects Zulip Server versions prior to 2.1.3. The issue is a cross-site scripting vulnerability exploitable via the modal_link feature in the Markdown functionality, caused by insufficient validation of client-side data by the web application. Impact is XSS, with the practical conse...

CVE-2020-9444

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

CVE-2020-9444

Zulip Server prior to 2.1.3 is affected by CVE-2020-9444 due to a reverse tabnabbing issue in the Markdown functionality. The root cause is exposed in Zulip’s Markdown handling, allowing an attacker to harness tabnabbing behavior. The vulnerability affects Zulip Server versions before 2.1.3; reme...

CVE-2020-10935

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

Zulip account takeover via stored XSS

Advisory ID Internal CORE-2020-0002 1. Advisory Information Title: Zulip account takeover via stored XSS Advisory ID: CORE-2020-0002 Advisory URL: https://www.coresecurity.com/advisories/zulip-account-takeover-stored-xss Date published: 2020-04-02 Date of last update: 2020-03-27 Vendors contacted...

CVE-2019-19775

The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users...

CVE-2019-19775

The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users...

Open redirect

The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users...

CVE-2019-19775

CVE-2019-19775 concerns Zulip Server: the image thumbnailing handler in versions 1.9.0 through before 2.0.8 allowed an open redirect that was visible to logged-in users. The impact, as stated in sources, is an open redirect targeting arbitrary URLs, potentially aiding phishing or credential-reuse...

CVE-2019-19775

The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users...

Zulip Server Open Redirect Vulnerability

Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations. An open redirection vulnerability exists in the image thumbnail handler in Zulip Server. No detailed vulnerability details are provided at this...