PT-2021-15254

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 3.11 Rocket.Chat version 3.10.5 Rocket.Chat version 3.9.7 Rocket.Chat version 3.8.8 Description The issue allows a remote attacker to inject arbitrary JavaScript in a message using nested markdown tags, leading to...

CVE-2021-22886: Improper Neutralization of Input During Web Page Generation

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting XSS using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app...