610 matches found
CVE-2019-16215
The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages...
Code injection
The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages...
Cross site scripting
Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...
CVE-2019-16216
Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...
CVE-2019-16216
Zulip server before 2.0.5 (local uploads) and before 2.0.5 (S3 uploads) mishandled MIME type validation for uploaded files, enabling a stored XSS across logged-in users. On local uploads, the attack affects browsers without CSP support (e.g., IE11); on S3, the impact is limited to the configured ...
CVE-2019-16215
CVE-2019-16215 affects the Zulip server before 2.0.5. The Markdown parser uses a regular expression vulnerable to exponential backtracking, allowing a logged-in user to craft a message that could cause the server to consume excessive CPU time and stall processing of subsequent messages. The Red H...
CVE-2019-16215
The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages...
PT-2019-14585 · Zulip · Zulip Server
Name of the Vulnerable Software and Affected Versions: Zulip server versions prior to 2.0.5 Description: The issue concerns the Markdown parser in the Zulip server, which used a regular expression vulnerable to exponential backtracking. This could allow a logged-in user to send a crafted message,...
Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08598)
Zulip Server is a set of open source group chat application written in Python based on the Django framework . A cross-site scripting vulnerability exists in versions of Zulip Server prior to 1.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
Zulip Server Cross-Site Scripting Vulnerability
Zulip Server is a set of open source group chat application written in Python based on the Django framework . A cross-site scripting vulnerability exists in versions of Zulip Server prior to 1.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08599)
Zulip Server is a set of open source group chat application written in Python based on the Django framework . A cross-site scripting vulnerability exists in Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script ...
Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08600)
Zulip Server is a set of open source group chat application written in Python based on the Django framework . frontend markdown processor is one of the front-end markdown markup language processor . A cross-site scripting vulnerability exists in the frontend markdown processor in Zulip Server...
Cross site scripting
In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications...
Cross site scripting
In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead...
CVE-2018-9987
In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications...
CVE-2018-9990
In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead...
CVE-2018-9999
In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...
CVE-2018-9987
In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications...