https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:32:48 +0000 https://vulnerability.circl.lu/vuln/cnvd-2018-13099 cnvd-2018-13099 https://vulnerability.circl.lu/vuln/cnvd-2018-13099 https://vulnerability.circl.lu/vuln/fkie_cve-2018-13878 <p>An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.</p> <p>An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2018-13878 https://vulnerability.circl.lu/vuln/ghsa-8f7m-2hjp-gccx <p>An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.</p> <p>An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.</p> https://vulnerability.circl.lu/vuln/ghsa-8f7m-2hjp-gccx https://vulnerability.circl.lu/vuln/gsd-2018-13878 gsd-2018-13878 https://vulnerability.circl.lu/vuln/gsd-2018-13878 https://vulnerability.circl.lu/vuln/var-201807-0823 <p>An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel. Rocket.Chat Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Rocket.Chat is an open source web chat server built in JavaScript using the Meteorfullstack framework. A cross-site scripting vulnerability exists in the packages/rocketchat-mentions/Mentions.js file in versions prior to Rocket.Chat 0.65, which was caused by the program&#39;s failure to encode the real name of the displayed username</p> <p>An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel. Rocket.Chat Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Rocket.Chat is an open source web chat server built in JavaScript using the Meteorfullstack framework. A cross-site scripting vulnerability exists in the packages/rocketchat-mentions/Mentions.js file in versions prior to Rocket.Chat 0.65, which was caused by the program&#39;s failure to encode the real name of the displayed username</p> https://vulnerability.circl.lu/vuln/var-201807-0823