CVE-2020-14194

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...

CVE-2020-14215

Zulip Server before 2.1.5 has Incorrect Access Control because 0198preregistrationuserinvitedas adds the administrator role to invitations...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-14194

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...

CVE-2020-15070

Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value...

CVE-2020-14215

Zulip Server before 2.1.5 has Incorrect Access Control because 0198preregistrationuserinvitedas adds the administrator role to invitations...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

Information disclosure

Zulip Server before 2.1.5 has Incorrect Access Control because 0198preregistrationuserinvitedas adds the administrator role to invitations...

Design/Logic Flaw

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...

Code injection

Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value...

Cross site scripting

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-15070

Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value...

CVE-2020-12759

CVE-2020-12759 affects Zulip Server prior to 2.1.5, with a reflected XSS vulnerability via the Dropbox webhook. Public records across NVD/Red Hat OSV/CVE entries confirm the issue in Zulip Server before 2.1.5 and indicate the root cause as unsafe handling of the webhook payload leading to cross-s...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-14194

CVE-2020-14194 affects Zulip Server prior to 2.1.5. The issue is a reverse tabnapping vulnerability triggered by a topic header link, enabling tabnabbing conditions in the Zulip web UI. Exploitation details are not provided beyond the reverse tabnapping description in the connected documents; no ...

CVE-2020-14194

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link...

CVE-2020-14215

CVE-2020-14215 affects Zulip Server up to version 2.1.4 (fixed in 2.1.5). Root cause: the 0198_preregistrationuser_invited_as logic adds the administrator role to invite objects, enabling insufficient access control. Impact: potential elevation of privileges via invitations, with impact to confid...

CVE-2020-14215

Zulip Server before 2.1.5 has Incorrect Access Control because 0198preregistrationuserinvitedas adds the administrator role to invitations...

CVE-2020-15070

Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value...

CVE-2020-15070

Zulip Server 2.x before 2.1.7 is affected by an eval-injection vulnerability that an attacker with privilege and access to write to the PostgreSQL database can exploit by crafting a custom profile field value. The root cause is the ability to inject and evaluate code via a crafted value stored in...