Cross site scripting

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

CVE-2018-9990

In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead...

Cross site scripting

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

CVE-2018-9986

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

CVE-2018-9990

CVE-2018-9990 affects Zulip Server prior to 1.7.2, where an XSS flaw exists in stream names used by the topic typeahead. Affected product is Zulip Server; root cause is an XSS in the UI typeahead for stream names (no exploit details provided in the documents). The issue is mitigated by updating t...

CVE-2018-9990

In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead...

CVE-2018-9987

In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications...

CVE-2018-9987

CVE-2018-9987 concerns Zulip Server prior to 1.7.2, where versions 1.5.x, 1.6.x and 1.7.x were affected by an XSS issue triggered when muting notifications. The vulnerability affects the Zulip Server (Python/Django-based chat platform) and is triggered in the input handling related to notificatio...

CVE-2018-9999

CVE-2018-9999 affects Zulip Server prior to 1.7.2. The issue is an XSS vulnerability triggered by user uploads when using the default LOCAL_UPLOADS_DIR storage backend. The connected sources confirm this is a cross-site scripting flaw in versions

CVE-2018-9986

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

CVE-2018-9986

Summary: CVE-2018-9986 affects Zulip Server prior to 1.7.2, where the frontend markdown processor allows cross-site scripting (XSS). What’s affected: Zulip Server versions before 1.7.2; vulnerable component is the frontend markdown processor used for rendering content. Impact (as described): An a...

CVE-2018-9999

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

Zulip Server invitation system unauthorized operation vulnerability

Zulip Server is a set of open source group chat application written in Python based on the Django framework. invitation system is one of the invitation system . A security vulnerability exists in the invitation system in Zulip Server versions prior to 1.7.1. An attacker can exploit this...

Design/Logic Flaw

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

CVE-2017-0910

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

CVE-2017-0910

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

CVE-2017-0910

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm...

CVE-2017-0910

Zulip Server (open-source group chat) before 1.7.1 contains an invitation-system vulnerability on multi-realm servers: an authorized user of one realm can create a user account on any other realm. Affected: Zulip Server versions prior to 1.7.1. Mitigation often cited as upgrading to 1.7.1 or appl...

Unspecified Vulnerability in Zulip Server

Zulip Server is a set of open source group chat application written in Python based on the Django framework . A security vulnerability exists in the implementation of the invitebyadminsonly setting in Zulip Server 1.5.1 and earlier versions. An attacker can exploit the vulnerability to invite oth...

CVE-2017-0896

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invitebyadminsonly setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this...