Authorization

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

Authorization

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection...

CVE-2017-18872

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

CVE-2017-18894

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover...

CVE-2017-18894

Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 is affected when used as an OAuth 2.0 service provider: resource-owner authorization can be intermittently bypassed, enabling account takeover. Root cause: bypass of resource-owner authorization in OAuth 2.0 flow. Impact: potential account takeover...

CVE-2017-18897

CVE-2017-18897 affects Mattermost Server pre-4.2.0, 4.1.1 and 4.0.5 when used as an OAuth 2.0 service provider. The issue is that the implementation mishandles a deny action for a redirection, constituting a logic/process flow problem in the OAuth redirect handling. Publicly provided connected so...

CVE-2017-18897

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection...

CVE-2017-18883

The CVE-2017-18883 entry concerns Mattermost Server versions prior to 4.3.0, 4.2.1, and 4.1.2 when acting as an OAuth 2.0 Service Provider. The underlying issue is low entropy for authorization data, as described in Red Hat, SUSE, and other connected sources. The affected component is the OAuth 2...

CVE-2017-18883

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

CVE-2017-18872

Mattermost Server, prior to version 4.4.3 and 4.3.3, is affected. In these releases, when Mattermost operates as an OAuth 2.0 service provider, an issue could allow attackers to reconfigure an OAuth app in some scenarios. The vulnerability centers on the OAuth app configuration within mattermost-...

CVE-2017-18877

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...

CVE-2017-18877

Mattermost Server contains an XSS vulnerability in the OAuth 2.0 allow/deny page for affected releases (Mattermost Server before 4.3.0, 4.2.1, and 4.1.2). Root cause details are not provided in the documents beyond the page-level description. Exploitation status is not specified; no in-the-wild e...

EulerOS 2.0 SP2 : freerdp (EulerOS-SA-2020-1678)

According to the version of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in updatereadsynchronize that could lead to a later out-of-bounds...

EulerOS 2.0 SP2 : mercurial (EulerOS-SA-2020-1642)

According to the versions of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The mpatchapply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the...

EulerOS 2.0 SP2 : libgcrypt (EulerOS-SA-2020-1672)

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proxima...

EulerOS 2.0 SP2 : ipmitool (EulerOS-SA-2020-1649)

According to the version of the ipmitool package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party, which may...

EulerOS 2.0 SP2 : openssl110f (EulerOS-SA-2020-1629)

According to the versions of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in...

EulerOS 2.0 SP2 : xerces-c (EulerOS-SA-2020-1640)

According to the version of the xerces-c package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not be...