Zulip Server eval injection vulnerability

Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. Zulip Server suffers from an eval injection vulnerability. An attacker who can write directly to the postgres...

Zulip Server Cross-Site Scripting Vulnerability (CNVD-2020-49009)

Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. A reflective cross-site scripting vulnerability exists in Zulip Server versions prior to 2.1.5. An attacker ca...

Zulip Server Reverse Tag Kidnapping Vulnerability

Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. A reverse tag kidnapping vulnerability exists in Zulip Server versions prior to 2.1.5. An attacker can exploit...

Zulip Server Access Control Error Vulnerability

Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. An access control error vulnerability exists in Zulip Server versions prior to 2.1.5. The vulnerability stems...

The vulnerability of the “invite_by_admins_only” permission implementation in the Zulip Server group chat application allows a violator to gain unauthorized access to protected information.

The vulnerability of the “invitebyadminsonly” permission implementation in the Zulip Server group chat application is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Zulip Desktop Trust Management Issue Vulnerability

Zulip Desktop is a desktop version of the team chat application from Zulip USA. A trust management issue vulnerability exists in Zulip Desktop versions prior to 5.2.0, which stems from a lack of validation of SSL certificates. The vulnerability can be exploited by an attacker to obtain sensitive...

CVE-2020-12637

Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option...

CVE-2020-12637

Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option...

Input validation

Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option...

CVE-2020-12637

CVE-2020-12637 affects Zulip Desktop prior to 5.2.0. The issue is missing SSL certificate validation caused by SSL validation being inadvertently disabled during handling of the ignoreCerts option, enabling potential network-based interception. Connected sources indicate high/severe CVSS scores (...

CVE-2020-12637

Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option...

Zulip server Markdown parser cross-site scripting vulnerability

Zulip server is an open source team chat application from Zulip Inc.Markdown parser is one of the Markdown markup language parser. A cross-site scripting vulnerability exists in the modallink function of Markdown parser in Zulip Server versions prior to 2.1.3. The vulnerability stems from a lack ...

Unspecified vulnerability in Zulip server (CNVD-2021-28745)

Zulip server is an open source team chat application from the American company Zulip. A security vulnerability exists in Zulip Server versions prior to 2.1.3. An attacker can exploit the vulnerability to reverse tag via the dropdown feature...

Zulip server cross-site scripting vulnerability (CNVD-2020-33258)

Zulip server is an open source team chat application from the American company Zulip. A cross-site scripting vulnerability exists in Zulip Server versions prior to 2.1.3. The vulnerability stems from the WEB application's lack of proper validation of client-side data. An attacker can exploit this...

CVE-2020-9444

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

CVE-2020-9445

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

CVE-2020-10935

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

CVE-2020-9445

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

CVE-2020-10935

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

CVE-2020-9444

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...