CVE Daily – Rocket.Chat https://cvedaily.com/pages/tags/rocket-chat.html CVE Daily – Rocket.Chat en Wed, 03 Jun 2026 21:27:06 +0000 [Medium] CVE-2025-5892 – A vulnerability, which was classified as problematic, has been found in RocketCh... https://nvd.nist.gov/vuln/detail/CVE-2025-5892 https://nvd.nist.gov/vuln/detail/CVE-2025-5892 Mon, 09 Jun 2025 20:15:25 +0000 Medium CVE-2025-5892

A vulnerability, which was classified as problematic, has been found in RocketChat up to 7.6.1. This issue affects the function parseMessage of the file /apps/meteor/app/irc/server/servers/RFC2813/parseMessage.js. The manipulation of the argument line leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be u…

CVSS: 4.3 · CWE: CWE-400

View on NVD

]]> [Medium] CVE-2022-34802 – Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password a... https://nvd.nist.gov/vuln/detail/CVE-2022-34802 https://nvd.nist.gov/vuln/detail/CVE-2022-34802 Thu, 30 Jun 2022 18:15:13 +0000 Medium CVE-2022-34802

Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

CVSS: 4.3 · CWE: CWE-522

View on NVD

]]> [Medium] CVE-2022-21830 – A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could al... https://nvd.nist.gov/vuln/detail/CVE-2022-21830 https://nvd.nist.gov/vuln/detail/CVE-2022-21830 Fri, 01 Apr 2022 23:15:13 +0000 Medium CVE-2022-21830

A blind self XSS vulnerability exists in RocketChat LiveChat

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2022-28139 – A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earl... https://nvd.nist.gov/vuln/detail/CVE-2022-28139 https://nvd.nist.gov/vuln/detail/CVE-2022-28139 Tue, 29 Mar 2022 13:15:08 +0000 Medium CVE-2022-28139

A missing permission check in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

CVSS: 4.3 · CWE: CWE-862

View on NVD

]]> [Medium] CVE-2022-28138 – A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier... https://nvd.nist.gov/vuln/detail/CVE-2022-28138 https://nvd.nist.gov/vuln/detail/CVE-2022-28138 Tue, 29 Mar 2022 13:15:08 +0000 Medium CVE-2022-28138

A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.

CVSS: 4.3 · CWE: CWE-352

View on NVD

]]> [Medium] CVE-2018-13879 – A reflected XSS issue was discovered in the registration form in Rocket.Chat bef... https://nvd.nist.gov/vuln/detail/CVE-2018-13879 https://nvd.nist.gov/vuln/detail/CVE-2018-13879 Wed, 11 Jul 2018 01:29:01 +0000 Medium CVE-2018-13879

A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via packages/rocketchat-ui-login/client/username/username.js in packages/rocketchat-ui-login/client/username/username…

CVSS: 5.4 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2018-13878 – An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocke... https://nvd.nist.gov/vuln/detail/CVE-2018-13878 https://nvd.nist.gov/vuln/detail/CVE-2018-13878 Wed, 11 Jul 2018 01:29:01 +0000 Medium CVE-2018-13878

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]>