CVE-2020-9444

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

CVE-2020-10935

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

CVE-2020-9445

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

CVE-2020-9444

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

Design/Logic Flaw

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

Design/Logic Flaw

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

Design/Logic Flaw

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

CVE-2020-9445

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

CVE-2020-9445

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

CVE-2020-9445

Zulip Server before 2.1.3 allows XSS via the modallink feature in the Markdown functionality...

CVE-2020-9445

CVE-2020-9445 affects Zulip Server versions prior to 2.1.3. The issue is a cross-site scripting vulnerability exploitable via the modal_link feature in the Markdown functionality, caused by insufficient validation of client-side data by the web application. Impact is XSS, with the practical conse...

CVE-2020-9444

Zulip Server prior to 2.1.3 is affected by CVE-2020-9444 due to a reverse tabnabbing issue in the Markdown functionality. The root cause is exposed in Zulip’s Markdown handling, allowing an attacker to harness tabnabbing behavior. The vulnerability affects Zulip Server versions before 2.1.3; reme...

CVE-2020-9444

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

CVE-2020-9444

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality...

CVE-2020-10935

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover...

DEBIAN-CVE-2020-11888

python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute...

CVE-2020-11888

python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute...

CVE-2020-11888

CVE-2020-11888 affects python-markdown2 up to version 2.3.8, where XSS is possible due to mishandling of element names (e.g., elementname@ or elementname- with an onclick attribute). The provided connected documents indicate that later updates (e.g., 2.3.9) include XSS fixes, and openSUSE/Fedora ...

PT-2020-12434

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 2.1.3 Description The issue allows for cross-site scripting XSS via a Markdown link. This can result in account takeover. Recommendations For versions prior to 2.1.3, update to version 2.1.3 or later to resolve t...

PT-2020-20665

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 2.1.3 Description The issue allows for XSS via the modal link feature in the Markdown functionality. Recommendations For versions prior to 2.1.3, update to version 2.1.3 or later to resolve the issue...