cve.bz

mattermost mattermost server vulnerabilities, newest first, page 10

Filter
  1. 4.3CVE-2018-21261EPSS 0.6%

    An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges.

  2. 2.7CVE-2018-21260EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy.

  3. 5.3CVE-2018-21259EPSS 1.1%

    An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via a malformed link in a channel.

  4. 7.5CVE-2018-21258EPSS 1.2%

    An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.

  5. 5.3CVE-2018-21257EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) via the Channel header slash command API.

  6. 4.3CVE-2018-21255EPSS 0.6%

    An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.

  7. 4.3CVE-2018-21254EPSS 0.6%

    An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command.

  8. 4.3CVE-2018-21253EPSS 0.6%

    An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user.

  9. 9.8CVE-2018-21251EPSS 1.2%

    An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.

  10. 6.5CVE-2018-21250EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image dimensions.

  11. 3.7CVE-2018-21249EPSS 0.7%

    An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.

  12. 7.5CVE-2018-21248EPSS 1.2%

    An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials.

  13. 6.1CVE-2017-18877EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.

  14. 4.9CVE-2017-18876EPSS 0.9%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.

  15. 4.9CVE-2017-18875EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.

  16. 7.5CVE-2017-18871EPSS 1.1%

    An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.

  17. 4.3CVE-2017-18870EPSS 0.6%

    An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.

  18. 7.5CVE-2019-20874EPSS 1.2%

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change.

  19. 6.5CVE-2019-20873EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation.

  20. 5.5CVE-2019-20872EPSS 0.3%

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.

  21. 7.5CVE-2019-20871EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking.

  22. 4.3CVE-2019-20870EPSS 0.7%

    An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID.

  23. 5.3CVE-2019-20869EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel.

  24. 7.5CVE-2019-20868EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated.

  25. 5.3CVE-2019-20867EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post.

  26. 5.3CVE-2019-20866EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled.

  27. 8.8CVE-2019-20865EPSS 0.5%

    An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.

  28. 7.5CVE-2019-20863EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted.

  29. 7.5CVE-2019-20862EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands.

  30. 5.5CVE-2019-20860EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG document.

  31. 7.5CVE-2019-20859EPSS 1.2%

    An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.

  32. 7.5CVE-2019-20858EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL LIKE clause to an APIv4 endpoint.

  33. 7.5CVE-2019-20857EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backtick characters.

  34. 7.5CVE-2019-20855EPSS 1.2%

    An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment migration.

  35. 7.5CVE-2019-20854EPSS 1.3%

    An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX message.

  36. 6.5CVE-2020-14460EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001.

  37. 7.5CVE-2020-14459EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002.

  38. 7.5CVE-2020-14458EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004.

  39. 5.3CVE-2020-14457EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012.

  40. 7.5CVE-2020-14453EPSS 0.6%

    An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005.

  41. 5.3CVE-2020-14452EPSS 1.3%

    An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014.

  42. 7.5CVE-2020-14450EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-0017.

  43. 7.5CVE-2020-14448EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0020.

  44. 7.5CVE-2020-14447EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0021.

  45. 5.3CVE-2019-20847EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel.

  46. 7.5CVE-2019-20846EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage.

  47. 7.5CVE-2019-20845EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import.

  48. 6.5CVE-2019-20844EPSS 0.4%

    An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.

  49. 7.5CVE-2019-20843EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files.

  50. 7.2CVE-2019-20842EPSS 1.0%

    An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels.