GHSA-RM24-25XM-9454 Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...

Mattermost Server exposes information stored by a web browser

An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser...

GHSA-2J9C-76PP-XC5Q Mattermost Server allows XSS via redirect URL

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...

Mattermost Server has mishandled webhook access control

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case...

Mattermost Server allows XSS via CSRF

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...

Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

Mattermost Server allows XSS via redirect URL

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...

Mattermost Server exposes account details to any Team Administrator

An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details...

Mattermost Server allows System Admin to modify LDAP account names and email addresses

An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...

GHSA-VW57-55F8-C73Q Mattermost Server allows XSS via CSRF

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...

GHSA-HGRP-FGM8-56G8 Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

GHSA-H8QW-XQM9-Q66J Mattermost Server is vulnerable to XSS through customizable theme color-code values

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values...

Mattermost Server exposes sensitive information about team URLs via an API

An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API...

Mattermost Server: initial_load API exposes unnecessary information

An issue was discovered in Mattermost Server before 3.1.1. The initialload API disclosed unnecessary personal information...

Mattermost Server's Session ID and Session Token are potentially compromised

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

GHSA-9JRX-FGRM-96QH Mattermost Server is vulnerable to XSS via a Legal or Support setting

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting...

GHSA-J26G-95PH-2MWV Mattermost Server: Insufficient Password-Reset Link Invalidation

An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...

Insertion of Sensitive Information Into Sent Data

Overview github.com/mattermost/mattermost-server is an open source Slack-alternative in Golang and React. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the API process. An attacker can access sensitive information by sending crafted...

GHSA-FFCC-QR2V-3QMV Mattermost Server is vulnerable to Uncontrolled Resource Consumption

An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang...

Mattermost Server is vulnerable to Uncontrolled Resource Consumption

An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang...