CVE-2021-43799 RabbitMQ exposes ports with weak default secrets in Zulip Server

Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation until first reboot, or restart of RabbitMQ does not successfully limit the default ports which RabbitMQ opens; this...

CVE-2021-43799 RabbitMQ exposes ports with weak default secrets in Zulip Server

Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation until first reboot, or restart of RabbitMQ does not successfully limit the default ports which RabbitMQ opens; this...

CVE-2021-43799

Zulip Server before version 4.9 runs RabbitMQ for internal messaging, and at initial install may leave port 25672 open without strong protection. The RabbitMQ cookie is generated with a weak PRNG, yielding about 20 bits of entropy, enabling a remote attacker to brute-force the cookie if OS/networ...

Zulip Server 安全特征问题漏洞

Zulip server is an open source team chat application from the American company Zulip. A security signature issue vulnerability exists in Zulip Server versions prior to 4.9, which results from incorrect input validation. A remote attacker can exploit this vulnerability to send a crafted request an...

zulip cross-site scripting vulnerability

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. Zulip suffers from a cross-site scripting vulnerability that stems from a lack of data validation filtering of...

CVE-2021-3866

Cross-site Scripting XSS - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6...

CVE-2021-3866

Cross-site Scripting XSS - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6...

CVE-2021-3866 Cross-site Scripting (XSS) - Stored in zulip/zulip

Cross-site Scripting XSS - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6...

CVE-2021-3866

Summary: CVE-2021-3866 is a stored XSS vulnerability in the Zulip open-source project (zulip/zulip). The flaw arises from insufficient input validation/output encoding for user-supplied data, allowing crafted content to execute JavaScript in the client. The vulnerability is described as affecting...

Cross-site Scripting (XSS) - Stored in zulip/zulip

Description Zulip is a powerful, open source group chat application that combines the immediacy of real-time chat with the productivity benefits of threaded conversations. Zulip is used by open source projects, Fortune 500 companies, large standards bodies, and others who need a real-time chat...

Zulip code issue vulnerability

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, Zulip suffers from a code issue vulnerability that stems from improper design or implementation during the code...

CVE-2021-43791

Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a...

CVE-2021-43791

Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a...

Design/Logic Flaw

Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a...

CVE-2021-43791 Ineffective expiration validation for invitation links in Zulip

Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a...

CVE-2021-43791

Zulip 4.x vulnerability (CVE-2021-43791): Expired invitation confirmation keys were not properly validated in the new account registration flow. The check_prereg_key_and_redirect step validated the key, but /accounts/register/ did not, allowing registration with an expired key. Impact: potential ...

Zulip 代码问题漏洞

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, Zulip suffers from a code issue vulnerability that stems from improper design or implementation during the code...

GHSA-4VR9-8CJF-VF9C Async-h1 request smuggling possible with long unread bodies

Impact This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content...

Async-h1 request smuggling possible with long unread bodies

Impact This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content...