CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-21830
https://notcve.org/view.php?id=CVE-2022-21830
A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance. Se presenta una vulnerabilidad de tipo auto XSS ciega en RocketChat LiveChat versiones anteriores a v1.9, que podría permitir a un atacante engañar a una víctima pegando código malicioso en su instancia de chat • https://hackerone.com/reports/1091118 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8291
https://notcve.org/view.php?id=CVE-2020-8291
A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks. Un problema de renderización de la vista previa de los enlaces en Rocket.Chat versiones anteriores a 3.9, podía conllevar a posibles ataques de tipo XSS • https://github.com/RocketChat/Rocket.Chat/pull/19854 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-32832 – ReDOS in Rocket.Chat
https://notcve.org/view.php?id=CVE-2021-32832
Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13. Rocket.Chat es una plataforma de comunicaciones de código abierto totalmente personalizable y desarrollada en JavaScript. En Rocket.Chat versiones anteriores a 3.11.3, 3.12.2 y 3.13, un problema con determinadas expresiones regulares podía conllevar potencialmente a una denegación de servicio. • https://docs.rocket.chat/guides/security/security-updates https://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094c https://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3 https://securitylab.github.com/advisories/GHSL-2020-310-redos-Rocket.Chat • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-22910
https://notcve.org/view.php?id=CVE-2021-22910
A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE. Se presenta una vulnerabilidad de saneo en Rocket.Chat server versiones anteriores a 3.13.2, anteriores a 3.12.4, anteriores a 3.11.4, que permitía realizar consultas a un endpoint que podía dar lugar a una inyección NoSQL, conllevando potencialmente a un RCE • https://blog.sonarsource.com/nosql-injections-in-rocket-chat https://hackerone.com/reports/1130874 • CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-26763
https://notcve.org/view.php?id=CVE-2020-26763
The Rocket.Chat desktop application 2.17.11 opens external links without user interaction. La aplicación de escritorio Rocket.Chat versión 2.17.11, abre enlaces externos sin la interacción de un usuario • https://github.com/RocketChat/Rocket.Chat.Electron/pull/1710 •