Rocket.chat: Security Vulnerabilities
The Rocket.Chat desktop application 2.17.11 opens external links without user interaction.
CVSS Score
7.5
EPSS Score
0.008
Published
2021-07-05
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.
CVSS Score
9.8
EPSS Score
0.952
Published
2021-05-27
An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks.
CVSS Score
7.5
EPSS Score
0.019
Published
2021-05-27
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
CVSS Score
6.1
EPSS Score
0.017
Published
2021-03-26
The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.
CVSS Score
5.4
EPSS Score
0.008
Published
2021-01-26
Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in message boxes.
CVSS Score
5.4
EPSS Score
0.009
Published
2021-01-26
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
CVSS Score
5.3
EPSS Score
0.108
Published
2021-01-08
Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.
CVSS Score
9.8
EPSS Score
0.016
Published
2020-12-30
Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side.
CVSS Score
6.1
EPSS Score
0.028
Published
2020-08-18
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
CVSS Score
6.1
EPSS Score
0.04
Published
2019-10-21