CVE-2017-14586

The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop clients at or above version 4.0 and before version 4.30 are affected by this vulnerability...

CVE-2017-14586

Summary: CVE-2017-14586 affects Hipchat for Mac desktop client versions 4.0 up to 4.29.x. The vulnerability arises from how video call links are parsed, enabling client-side remote code execution. The issue is documented as affecting 4.0–

CVE-2017-14585

A Server Side Request Forgery SSRF vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affecte...

Atlassian HipChat Server 1.0 < 2.2.4 Image Upload RCE

The version of Atlassian HipChat Server installed on the remote host is 1.0 or later but prior to 2.2.4. It is, therefore, affected by a remote code execution vulnerability due to improper validation of uploaded images. An authenticated, remote attacker can exploit this, via a specially crafted...

Hipchat Server Arbitrary Code Execution Vulnerability

Hipchat Server is a set of team chat tools that supports group and 1-to-1 voice and video chat with screen sharing. A security vulnerability exists in Hipchat Server versions prior to 2.2.3. A remote attack could exploit the vulnerability to execute arbitrary code via an imported file...

Atlassian Hipchat for iOS Man-in-the-Middle Attack Vulnerability

Atlassian Hipchat for iOS is a suite of team chat tools for iOS from the Australian company Atlassian that supports group and 1-to-1 voice and video chat with screen sharing. A security vulnerability exists in Atlassian HipChat for iOS versions prior to 3.16.2. An attacker can exploit the...

CVE-2017-8080

Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads...

CVE-2017-8080

Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads...

Code injection

Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads...

CVE-2017-8080

Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors involving image uploads...

CVE-2017-8080

CVE-2017-8080 affects Atlassian HipChat Server prior to 2.2.4. The issue allows remote authenticated users with user-level privileges to execute arbitrary code via vectors involving image uploads due to improper validation of uploaded images. An authenticated, remote attacker can exploit this by ...

CVE-2017-8058

Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call...

CVE-2017-8058

Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call...

Design/Logic Flaw

Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call...

CVE-2017-8058

Affected software: Atlassian HipChat for iOS (before 3.16.2). Vulnerability: Acceptance of invalid/self-signed TLS certificates in the login API flow, enabling a man-in-the-middle or proximate attacker to silently intercept information. Root cause (as described): TLS certificate validation is byp...

CVE-2017-8058

Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call...

Atlassian Hipchat Server Remote Code Execution Vulnerability

Atlassian JIRA is a defect tracking management system from Atlassian Australia, which is used to track and manage all kinds of issues and defects in the workplace.HipChat is one of the plug-ins that provides group chat, file sharing, video chat and screen sharing features. A remote code execution...

On SOURCE Boston, DoublePulsar, and HipChat

Mike Mimoso and Chris Brook recap this year’s SOURCE Boston Conference and discuss the week in news, including the long term implications of the NSA’s DoublePulsar exploit, and the HipChat breach. Download: ThreatpostNewsWrapApril282017.mp3...

Atlassian Resets HipChat Passwords Following Breach

Atlassian reset user passwords for its group chat service HipChat on Monday following an incident that may have resulted in unauthorized access to a server used by the service. The company began warning users Monday via email that as a result an attacker may have secured access to user informatio...

Atlassian's HipChat Hacked — Users' Data May Have Been Compromised

Atlassian's group chat platform HipChat is notifying its users of a data breach after some unknown hacker or group of hackers broke into one of its servers over the weekend and stole a significant amount of data, including group chat logs. What Happened? According to a security notice published o...