CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-9999
https://notcve.org/view.php?id=CVE-2018-9999
18 Apr 2018 — In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the (default) LOCAL_UPLOADS_DIR storage backend. En las versiones anteriores a la 1.7.2 de Zulip Server, había un problema de Cross-Site Scripting (XSS) con las subidas de usuarios y el backend de almacenamiento (por defecto) LOCAL_UPLOADS_DIR. • https://blog.zulip.org/2018/04/12/zulip-1-7-2-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0910
https://notcve.org/view.php?id=CVE-2017-0910
27 Nov 2017 — In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm. En Zulip Server en versiones anteriores a la 1.7.1, en un servidor con múltiples dominios, una vulnerabilidad en el sistema de invitación deja que un usuario autorizado de un dominio del servidor cree un usuario en cualquier otro dominio. • http://blog.zulip.org/2017/11/23/zulip-1-7-1-released • CWE-287: Improper Authentication CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 19EXPL: 0CVE-2017-0896
https://notcve.org/view.php?id=CVE-2017-0896
02 Jun 2017 — Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this. Zulip Server versión 1.5.1 y posteriores, sufre de un error en la implementación de la configuración de invite_by_admins_only en el servidor de aplicaciones de chat del grupo Zulip que permitió a un usuario autenticad... • https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b • CWE-285: Improper Authorization CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0881
https://notcve.org/view.php?id=CVE-2017-0881
28 Mar 2017 — An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server. Un error en la implementación de una función de suscripción automática en la ruta check_stream_exists del servidor de aplicaciones de chat en grupo Zulip en... • http://www.securityfocus.com/bid/97159 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •