Filtered by vendor Rocket.chat Subscriptions
Filtered by product Rocket.chat Subscriptions
Total 49 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-23917 1 Rocket.chat 1 Rocket.chat 2025-03-12 8.8 High
A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.
CVE-2023-23911 1 Rocket.chat 1 Rocket.chat 2025-02-28 7.5 High
An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room.
CVE-2023-28318 1 Rocket.chat 1 Rocket.chat 2025-01-29 5.3 Medium
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message_KeepHistory or Message_ShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices.
CVE-2023-28317 1 Rocket.chat 1 Rocket.chat 2025-01-29 5.3 Medium
A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order.
CVE-2023-28316 1 Rocket.chat 1 Rocket.chat 2025-01-29 9.8 Critical
A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.
CVE-2023-28357 1 Rocket.chat 1 Rocket.chat 2025-01-27 4.3 Medium
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a member of a channel that they do not have access to.
CVE-2023-28359 1 Rocket.chat 1 Rocket.chat 2025-01-27 5.3 Medium
A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the potential for limited impact.
CVE-2023-28358 1 Rocket.chat 1 Rocket.chat 2025-01-27 6.1 Medium
A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.
CVE-2023-28356 1 Rocket.chat 1 Rocket.chat 2025-01-27 7.5 High
A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to enter a hot loop on one of the processes, consuming ~120% CPU and rendering the service unresponsive.
CVE-2023-28325 1 Rocket.chat 1 Rocket.chat 2025-01-27 6.5 Medium
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.
CVE-2024-37405 1 Rocket.chat 1 Rocket.chat 2024-11-21 N/A
Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory.
CVE-2022-35248 1 Rocket.chat 1 Rocket.chat 2024-11-21 8.8 High
A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the server to use CAS during login.
CVE-2021-32832 1 Rocket.chat 1 Rocket.chat 2024-11-21 4.3 Medium
Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.
CVE-2021-22911 1 Rocket.chat 1 Rocket.chat 2024-11-21 9.8 Critical
A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.
CVE-2021-22910 1 Rocket.chat 1 Rocket.chat 2024-11-21 9.8 Critical
A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE.
CVE-2021-22892 1 Rocket.chat 1 Rocket.chat 2024-11-21 7.5 High
An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks.
CVE-2021-22886 1 Rocket.chat 1 Rocket.chat 2024-11-21 6.1 Medium
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
CVE-2020-8292 1 Rocket.chat 1 Rocket.chat 2024-11-21 5.4 Medium
Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in message boxes.
CVE-2020-8291 1 Rocket.chat 1 Rocket.chat 2024-11-21 6.1 Medium
A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.
CVE-2020-8288 1 Rocket.chat 1 Rocket.chat 2024-11-21 5.4 Medium
The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.