cve.bz

mattermost mattermost server vulnerabilities, newest first, page 9

Filter
  1. 8.8CVE-2017-18903EPSS 0.4%

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.

  2. 5.3CVE-2017-18902EPSS 0.9%

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.

  3. 5.3CVE-2017-18901EPSS 0.9%

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.

  4. 9.8CVE-2017-18900EPSS 1.3%

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.

  5. 5.3CVE-2017-18899EPSS 1.1%

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting.

  6. 5.3CVE-2017-18898EPSS 1.1%

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.

  7. 6.1CVE-2017-18897EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.

  8. 5.3CVE-2017-18896EPSS 0.8%

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.

  9. 5.3CVE-2017-18895EPSS 0.9%

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.

  10. 8.1CVE-2017-18894EPSS 0.8%

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover.

  11. 6.1CVE-2017-18893EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.

  12. 6.1CVE-2017-18892EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.

  13. 6.1CVE-2017-18891EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.

  14. 4.3CVE-2017-18890EPSS 0.8%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.

  15. 4.3CVE-2017-18889EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.

  16. 9.8CVE-2017-18888EPSS 1.1%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.

  17. 5.3CVE-2017-18887EPSS 0.9%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.

  18. 8.8CVE-2017-18886EPSS 1.0%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.

  19. 9.8CVE-2017-18885EPSS 1.2%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.

  20. 8.1CVE-2017-18884EPSS 0.8%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.

  21. 9.1CVE-2017-18883EPSS 1.1%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.

  22. 6.1CVE-2017-18882EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data.

  23. 6.1CVE-2017-18881EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command.

  24. 6.1CVE-2017-18880EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the title_link field of a Slack attachment.

  25. 6.1CVE-2017-18879EPSS 0.7%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.

  26. 4.3CVE-2017-18878EPSS 0.8%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.

  27. 6.5CVE-2017-18874EPSS 1.2%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.

  28. 8.8CVE-2018-21264EPSS 1.1%

    An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response.

  29. 4.3CVE-2018-21256EPSS 0.6%

    An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channel creation) via the Group message slash command.

  30. 4.3CVE-2018-21252EPSS 0.6%

    An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups.

  31. 5.3CVE-2017-18873EPSS 1.1%

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.

  32. 4.3CVE-2017-18872EPSS 0.6%

    An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.

  33. 4.3CVE-2019-20890EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions.

  34. 5.3CVE-2019-20889EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation.

  35. 7.5CVE-2019-20888EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory consumption) via an outgoing webhook or a slash command integration.

  36. 4.3CVE-2019-20887EPSS 0.7%

    An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can receive intra-team posts.

  37. 7.5CVE-2019-20886EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin.

  38. 7.5CVE-2019-20885EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file.

  39. 5.3CVE-2019-20884EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post.

  40. 4.3CVE-2019-20883EPSS 0.6%

    An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post.

  41. 5.3CVE-2019-20882EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team.

  42. 7.3CVE-2019-20881EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA.

  43. 7.5CVE-2019-20880EPSS 1.1%

    An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via OpenGraph.

  44. 4.3CVE-2019-20879EPSS 0.6%

    An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry.

  45. 4.3CVE-2019-20878EPSS 0.7%

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled.

  46. 5.3CVE-2019-20877EPSS 0.9%

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled.

  47. 5.4CVE-2019-20876EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy.

  48. 5.3CVE-2019-20875EPSS 0.8%

    An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed.

  49. 8.8CVE-2018-21263EPSS 0.9%

    An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response.

  50. 7.5CVE-2018-21262EPSS 1.1%

    An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text.