zulip

Zulip server provides an open-source team chat that helps teams stay productive and focused.

Zulip is an open-source team collaboration tool with topic-based threading.

In Zulip Server versions from 1.7.0 to before 2.0.7, a bug in the new user signup process meant that users who registered their account using social authentication (e.g., GitHub or Google SSO) in an organization that als…

Zulip is an open-source team collaboration tool.

Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.

Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value.

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.

Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote work productive and delightful.

Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking.

Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Z…

Zulip is an open-source team chat application.

Zulip is an open-source team collaboration tool.

Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat.

The image thumbnailing handler in Zulip Server versions 1.9.0 to before 2.0.8 allowed an open redirect that was visible to logged-in users.

In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead.

In Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2, there was an XSS issue with muting notifications.

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor.

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.

Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality.

Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.

Zulip is an open-source team collaboration tool.

An issue was discovered in Zulip Server before 3.4.

Zulip Server before 2.1.5 allows reverse tabnapping via a topic header link.

Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.