| CVE-2023-32677 | THẤP3.1 | Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip Server 6.1 and below, the UI which allows a user to invite a new user also allows | 19/05/2023 |
| CVE-2023-22735 | TRUNG BÌNH4.6 | Zulip is an open-source team collaboration tool. In versions of zulip prior to commit `2f6c5a8` but after commit `04cf68b` users could upload files with arbitrary `Content-Type` which would be served from the Zulip hostname with `Content-Disposition: inline` and no `Content-Security-Policy` header, allowing them to tri | 07/02/2023 |
| CVE-2022-41914 | THẤP3.7 | Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be possible for an atta | 16/11/2022 |
| CVE-2022-36048 | TRUNG BÌNH4.3 | Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. When displaying messages with embedded remote images, Zulip normally loads the image preview via a go-camo proxy server. However, an attacker who can send messages could include a crafted URL that tricks the server | 31/08/2022 |
| CVE-2022-35962 | TRUNG BÌNH5.7 | Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sent by an authenticated user could lead to credential disclosure if a user follows the link. A patch was released in version 27.190. | 29/08/2022 |
| CVE-2016-4427 | CAO7.5 | In zulip before 1.3.12, deactivated users could access messages if SSO was enabled. | 28/07/2022 |
| CVE-2016-4426 | TRUNG BÌNH4.3 | In zulip before 1.3.12, bot API keys were accessible to other users in the same realm. | 28/07/2022 |
| CVE-2022-31168 | CAO8.8 | Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who don’t own any bots, and | 22/07/2022 |
| CVE-2022-31134 | TRUNG BÌNH4.9 | Zulip is an open-source team collaboration tool. Zulip Server versions 2.1.0 above have a user interface tool, accessible only to server owners and server administrators, which provides a way to download a "public data" export. While this export is only accessible to administrators, in many configurations server admini | 12/07/2022 |
| CVE-2022-31017 | THẤP2.6 | Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with protected history, where new subscribers should not be allowed to see messages sent before they were subscribed, when edited causes the server to incorrectly sen | 25/06/2022 |
| CVE-2022-24751 | CAO7.4 | Zulip is an open source group chat application. Starting with version 4.0 and prior to version 4.11, Zulip is vulnerable to a race condition during account deactivation, where a simultaneous access by the user being deactivated may, in rare cases, allow continued access by the deactivated user. A patch is available in | 16/03/2022 |
| CVE-2022-23656 | TRUNG BÌNH5.4 | Zulip is an open source team chat app. The `main` development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several participants; a victi | 02/03/2022 |
| CVE-2021-3967 | CAO8.8 | Improper Access Control in GitHub repository zulip/zulip prior to 4.10. | 26/02/2022 |
| CVE-2022-21706 | NGHIÊM TRỌNG9.8 | Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control with multi-use invitations. A Zulip Server deployment which hosts multiple organizations is vulnerable to an attack where an invitation created in one organizati | 26/02/2022 |
| CVE-2021-43799 | NGHIÊM TRỌNG9.8 | Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server prior to 4.9, the initial installation (until first reboot, or restart of RabbitMQ) does not successfully limit the default ports which RabbitMQ opens; this includes port 25672, the | 25/01/2022 |
| CVE-2021-3866 | TRUNG BÌNH5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository zulip/zulip more than and including 44f935695d452cc3fb16845a0c6af710438b153d and prior to 3eb2791c3e9695f7d37ffe84e0c2184fae665cb6. | 20/01/2022 |
| CVE-2021-43791 | TRUNG BÌNH5.3 | Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a user to the check_prer | 02/12/2021 |
| CVE-2021-41115 | TRUNG BÌNH6.5 | Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers" that automatically create links from messages that users send, detected via arbitrary regular expressions. Malicious organization administrators could subject the server to a den | 07/10/2021 |
| CVE-2021-30487 | THẤP2.7 | In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation. | 15/04/2021 |
| CVE-2021-30479 | TRUNG BÌNH5.3 | An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization. | 15/04/2021 |