38617 matches found
CVE-2016-11079
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...
CVE-2016-11078
Mattermost Server prior to 3.0.0 is affected. The issue allows an attacker to obtain sensitive information (credential fields in config.json) through the System Console UI. Root cause: exposure of credentials via the System Console; impact concerns confidentiality (C in CVSS v3.1). No remediation...
CVE-2016-11077
Mattermost Server prior to version 3.0.0 contains a superfluous API that allows the System Admin to change the account name and e-mail address of an LDAP account. This is documented across multiple sources (SUSE, Red Hat, GHSA, OSV) and is the stated impact; no further exploit details are provide...
CVE-2016-11076
Summary: Mattermost Server prior to 3.0.0 does not ensure cookies are transmitted over SSL. This is the root cause described consistently across CVE-2016-11076 references (NVD, Red Hat, SUSE, osv.dev). The connected documents confirm the same issue; no public exploit details or remediation steps ...
CVE-2016-11075
Mattermost Server
CVE-2016-11074
The CVE-2016-11074 entry concerns Mattermost Server prior to 3.0.0, where a password-reset link could be reused. This implies a potential account compromise via re-use of password-reset tokens. The connected sources provide concrete fix guidance: upgrade Mattermost Server to 3.0.0 or newer (e.g.,...
CVE-2016-11073
CVE-2016-11073 affects Mattermost Server prior to 3.0.0, enabling cross-site scripting via a Legal or Support setting. All connected sources consistently state the issue but do not provide concrete remediation steps or version-specific fixes in the documents. Practical impact is XSS, with no expl...
CVE-2016-11072
Mattermost Server pre-3.0.2 contains a vulnerability where the purposes of a session ID and a Session Token are mishandled. Affected product is Mattermost Server before version 3.0.2. The available connected documents corroborate the issue description but do not provide explicit remediation steps...
CVE-2016-11071
Mattermost Server (before 3.1.0) is vulnerable to XSS via missing noreferrer and noopener link-rel protection. The root cause is failure to apply proper link relationship attributes, enabling malicious scripts when users click crafted links. Remediation: upgrade github.com/mattermost/mattermost-s...
CVE-2016-11069
Mattermost Server (before 3.2.0) contains a vulnerability in the password-change flow where brute-force attempts are mishandled, potentially enabling repeated password-change attempts. Affected product: Mattermost Server; initial description specifies 3.2.0 as the fixed version. Root cause: impro...
CVE-2016-11068
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection...
CVE-2016-11068
Mattermost Server prior to 3.2.0 is affected by an LDAP injection flaw that allows attackers to read LDAP fields. The issue is documented across multiple sources (NVD entry CVE-2016-11068, SUSE, Red Hat, OSV, and other feeds). The available descriptions consistently state that the vulnerability i...
CVE-2016-11067
Mattermost Server prior to version 3.2.0 is affected by CVE-2016-11067, where crafted posts could cause a web browser to hang. The provided documents mention the affected product and impact but do not specify the root cause details, exploit specifics, or a documented fix. No concrete remediation ...
CVE-2016-11066
Summary: CVE-2016-11066 affects Mattermost Server prior to 3.2.0. Vulnerability details (supported by connected docs): The initial_load API exposes unnecessary personal information. This is the stated root cause across multiple advisories (Mattermost server before 3.2.0). Impact (as described): P...
CVE-2016-11065
Mattermost Server before 3.3.0 is affected. The vulnerability stems from the WebSocket feature allowing an attacker to send pop-up messages to users or alter a post’s appearance. The descriptions across connected documents confirm the affected software and the underlying impact, but do not specif...
CVE-2016-11064
Mattermost Desktop App fixed for CVE-2016-11064. Before 3.4.0, it is vulnerable to code execution via injection where strings could be executed as code. Affected component: Mattermost Desktop App. Root cause: injection allowing code execution through untrusted input during code segment constructi...
CVE-2016-11063
Mattermost Server prior to 3.5.1 is affected by a Cross‑Site Scripting (XSS) vulnerability via the file preview feature. This is confirmed across multiple sources (SUSE SUSECVEs, Red Hat, OpenSUSE advisories and OSV/NVD entries). The root cause is described as an XSS condition in the file preview...
CVE-2016-11062
Mattermost Server prior to 3.5.1 is affected by CVE-2016-11062, where email address verification can be bypassed. This vulnerability is described across multiple sources (NVD, Red Hat, CNVD, OSV, etc.). The available documents do not provide concrete exploitation details, impact specifics beyond ...
Security Bulletin: Multiple vulnerabilities in GSKit affect IBM Workload Scheduler
Summary GSKit is used by IBM Workload Manager and is vulnerable to some OpenSSL vulnerabilities. IBM Workload Manager has addressed the applicable CVEs using an updated version of GSKit libraries. Vulnerability Details CVEID: CVE-2016-0705 DESCRIPTION: OpenSSL is vulnerable to a denial of service...
