CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16216
https://notcve.org/view.php?id=CVE-2019-16216
18 Sep 2019 — Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack is only effective against browsers lacking support for Content-Security-Policy such as Internet Explorer 11. On a Zulip server using the S3 uploads backend, the attack is confined to the origin of the configured S3... • https://blog.zulip.org/2019/09/11/zulip-server-2-0-5-security-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16215
https://notcve.org/view.php?id=CVE-2019-16215
18 Sep 2019 — The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages. El analizador Markdown en el servidor Zulip versiones anteriores a 2.0.5, usó una expresión regular vulnerable al backtracking exponencial. Un usuario que haya iniciado sesión en el servidor podría enviar un mensaj... • https://blog.zulip.org/2019/09/11/zulip-server-2-0-5-security-release • CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-9986
https://notcve.org/view.php?id=CVE-2018-9986
18 Apr 2018 — In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor. En las versiones anteriores a la 1.7.2 de Zulip Server, había problemas de Cross-Site Scripting (XSS) con el procesador de marcado del frontend. • https://blog.zulip.org/2018/04/12/zulip-1-7-2-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-9987
https://notcve.org/view.php?id=CVE-2018-9987
18 Apr 2018 — In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications. En las versiones 1.5.x, 1.6.x y 1.7.x anteriores a la 1.7.2 de Zulip Server, había un problema de Cross-Site Scripting (XSS) al silenciar notificaciones. • https://blog.zulip.org/2018/04/12/zulip-1-7-2-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-9990
https://notcve.org/view.php?id=CVE-2018-9990
18 Apr 2018 — In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead. En las versiones anteriores a la 1.7.2 de Zulip Server, había un problema de Cross-Site Scripting (XSS) con los nombres de transmisión en la escritura anticipada de temas. • https://blog.zulip.org/2018/04/12/zulip-1-7-2-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-9999
https://notcve.org/view.php?id=CVE-2018-9999
18 Apr 2018 — In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the (default) LOCAL_UPLOADS_DIR storage backend. En las versiones anteriores a la 1.7.2 de Zulip Server, había un problema de Cross-Site Scripting (XSS) con las subidas de usuarios y el backend de almacenamiento (por defecto) LOCAL_UPLOADS_DIR. • https://blog.zulip.org/2018/04/12/zulip-1-7-2-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0910
https://notcve.org/view.php?id=CVE-2017-0910
27 Nov 2017 — In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm. En Zulip Server en versiones anteriores a la 1.7.1, en un servidor con múltiples dominios, una vulnerabilidad en el sistema de invitación deja que un usuario autorizado de un dominio del servidor cree un usuario en cualquier otro dominio. • http://blog.zulip.org/2017/11/23/zulip-1-7-1-released • CWE-287: Improper Authentication CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2017-0896
https://notcve.org/view.php?id=CVE-2017-0896
02 Jun 2017 — Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this. Zulip Server versión 1.5.1 y posteriores, sufre de un error en la implementación de la configuración de invite_by_admins_only en el servidor de aplicaciones de chat del grupo Zulip que permitió a un usuario autenticad... • https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b • CWE-285: Improper Authorization CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0881
https://notcve.org/view.php?id=CVE-2017-0881
28 Mar 2017 — An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server. Un error en la implementación de una función de suscripción automática en la ruta check_stream_exists del servidor de aplicaciones de chat en grupo Zulip en... • http://www.securityfocus.com/bid/97159 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •