CVE-2016-11083

CVE-2016-11083 affects Mattermost Server prior to 2.2.0. The issue enables cross-site scripting (XSS) by configuring files to be opened in a browser window, allowing embedded scripts to run under certain conditions. The vulnerability originates from how files are rendered, not from external input...

CVE-2016-11081

CVE-2016-11081 affects Mattermost Server prior to 2.2.0. The issue allows unintended access to information stored by a web browser. The available documents do not provide the underlying root cause in detail, a concrete exploit scenario, affected components beyond the server version, or an officia...

CVE-2016-11080

Mattermost Server (Mattermost Server) before version 3.0.0 contains a vulnerability where a Team Administrator can access superfluous APIs to view account details. Affected component: server-side API exposing account data to higher-privilege users. Root cause: insufficient access control on accou...

CVE-2016-11079

Mattermost Server (github.com/mattermost/mattermost-server) contains an XSS flaw via the redirect URL in versions before 3.0.0. The root cause is improper handling/validation of the redirect URL parameter. Impact: attacker-supplied redirect can execute scripts in a user’s browser. Remediation: up...

CVE-2016-11079

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...

CVE-2016-11078

Mattermost Server prior to 3.0.0 is affected. The issue allows an attacker to obtain sensitive information (credential fields in config.json) through the System Console UI. Root cause: exposure of credentials via the System Console; impact concerns confidentiality (C in CVSS v3.1). No remediation...

CVE-2016-11077

Mattermost Server prior to version 3.0.0 contains a superfluous API that allows the System Admin to change the account name and e-mail address of an LDAP account. This is documented across multiple sources (SUSE, Red Hat, GHSA, OSV) and is the stated impact; no further exploit details are provide...

CVE-2016-11076

Summary: Mattermost Server prior to 3.0.0 does not ensure cookies are transmitted over SSL. This is the root cause described consistently across CVE-2016-11076 references (NVD, Red Hat, SUSE, osv.dev). The connected documents confirm the same issue; no public exploit details or remediation steps ...

CVE-2016-11075

Mattermost Server

CVE-2016-11074

The CVE-2016-11074 entry concerns Mattermost Server prior to 3.0.0, where a password-reset link could be reused. This implies a potential account compromise via re-use of password-reset tokens. The connected sources provide concrete fix guidance: upgrade Mattermost Server to 3.0.0 or newer (e.g.,...

CVE-2016-11073

CVE-2016-11073 affects Mattermost Server prior to 3.0.0, enabling cross-site scripting via a Legal or Support setting. All connected sources consistently state the issue but do not provide concrete remediation steps or version-specific fixes in the documents. Practical impact is XSS, with no expl...

CVE-2016-11072

Mattermost Server pre-3.0.2 contains a vulnerability where the purposes of a session ID and a Session Token are mishandled. Affected product is Mattermost Server before version 3.0.2. The available connected documents corroborate the issue description but do not provide explicit remediation steps...

CVE-2016-11071

Mattermost Server (before 3.1.0) is vulnerable to XSS via missing noreferrer and noopener link-rel protection. The root cause is failure to apply proper link relationship attributes, enabling malicious scripts when users click crafted links. Remediation: upgrade github.com/mattermost/mattermost-s...

CVE-2016-11070

Mattermost Server prior to version 3.1.0 is affected by an XSS vulnerability via theme color-code values. Root cause: improper handling/validation of user-provided theme color data that can be reflected in the client. Impact is documented as cross-site scripting with low to medium severity depend...

CVE-2016-11069

Mattermost Server (before 3.2.0) contains a vulnerability in the password-change flow where brute-force attempts are mishandled, potentially enabling repeated password-change attempts. Affected product: Mattermost Server; initial description specifies 3.2.0 as the fixed version. Root cause: impro...

CVE-2016-11068

Mattermost Server prior to 3.2.0 is affected by an LDAP injection flaw that allows attackers to read LDAP fields. The issue is documented across multiple sources (NVD entry CVE-2016-11068, SUSE, Red Hat, OSV, and other feeds). The available descriptions consistently state that the vulnerability i...

CVE-2016-11068

An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection...

CVE-2016-11067

Mattermost Server prior to version 3.2.0 is affected by CVE-2016-11067, where crafted posts could cause a web browser to hang. The provided documents mention the affected product and impact but do not specify the root cause details, exploit specifics, or a documented fix. No concrete remediation ...

CVE-2016-11066

Summary: CVE-2016-11066 affects Mattermost Server prior to 3.2.0. Vulnerability details (supported by connected docs): The initial_load API exposes unnecessary personal information. This is the stated root cause across multiple advisories (Mattermost server before 3.2.0). Impact (as described): P...

CVE-2016-11065

Mattermost Server before 3.3.0 is affected. The vulnerability stems from the WebSocket feature allowing an attacker to send pop-up messages to users or alter a post’s appearance. The descriptions across connected documents confirm the affected software and the underlying impact, but do not specif...