SUSE CVE-2016-11063

An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview...

SUSE CVE-2016-11066

An issue was discovered in Mattermost Server before 3.2.0. The initialload API disclosed unnecessary personal information...

SUSE CVE-2016-11068

An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection...

SUSE CVE-2016-11069

An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change...

SUSE CVE-2016-11071

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place...

SUSE CVE-2016-11072

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

SUSE CVE-2016-11074

An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...

SUSE CVE-2016-11076

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

SUSE CVE-2016-11077

An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...

SUSE CVE-2016-11078

An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information credential fields within config.json via the System Console UI...

SUSE CVE-2016-11079

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...

SUSE CVE-2016-11080

An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details...

SUSE CVE-2016-11081

An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser...

SUSE CVE-2016-11082

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link...

SUSE CVE-2016-11083

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...

SUSE CVE-2016-11084

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...

SUSE CVE-2017-18872

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

GO-2025-4050 Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server

Mattermost Server is vulnerable to XSS through customizable theme color-code values in github.com/mattermost/mattermost-server...

GO-2025-4045 Mattermost Server vulnerable to Cross-site Scripting through file preview feature in github.com/mattermost/mattermost-server

Mattermost Server vulnerable to Cross-site Scripting through file preview feature in github.com/mattermost/mattermost-server...

GO-2025-4035 Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...