GHSA-9X8X-W6G5-HX4W Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...

Mattermost Server exposes team creator's e-mail address to other members

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members...

Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...

Mattermost Server is vulnerable to Path Traversal when files are stored locally

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file...

Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

GHSA-8QG8-C7MW-6FJ7 Mattermost Server is vulnerable to Directory Traversal by System Admins

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal...

GHSA-5Q37-9874-QXCW Mattermost Server exposes information stored by a web browser

An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser...

Mattermost Server is vulnerable to Directory Traversal by System Admins

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal...

Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...

Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service application crash via an @ character before a JavaScript field name...

Mattermost Server is vulnerable to XSS through crafted links

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link...

GHSA-MJ8V-773W-5QHJ Mattermost Server allows System Admin to modify LDAP account names and email addresses

An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...

GHSA-2J9C-76PP-XC5Q Mattermost Server allows XSS via redirect URL

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...

GHSA-M78R-2X6W-QQJP Mattermost Server is vulnerable to XSS through crafted links

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link...

GHSA-G3F3-P9RC-775P Mattermost Server exposes account details to any Team Administrator

An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details...

GHSA-JC6W-8R7F-VMP5 Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service application crash via an @ character before a JavaScript field name...

GHSA-RM24-25XM-9454 Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...

Mattermost Server exposes information stored by a web browser

An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser...

GHSA-VW57-55F8-C73Q Mattermost Server allows XSS via CSRF

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...

GHSA-HGRP-FGM8-56G8 Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...