GHSA-379P-37XC-Q963 Mattermost Server does not check if cookies are used over SSL

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

GHSA-R93J-3MMP-PX57 Mattermost Server: initial_load API exposes unnecessary information

An issue was discovered in Mattermost Server before 3.1.1. The initialload API disclosed unnecessary personal information...

GHSA-43M6-WVC8-2M7J Mattermost Server's Session ID and Session Token are potentially compromised

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

GHSA-FFCC-QR2V-3QMV Mattermost Server is vulnerable to Uncontrolled Resource Consumption

An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang...

Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place...

Mattermost Server is vulnerable to XSS via a Legal or Support setting

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting...

Mattermost Server is vulnerable to Uncontrolled Resource Consumption

An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang...

Mattermost Server does not enforce rate limits on password change attempts

An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change...

Mattermost Server exposes sensitive information via its System Console UI

An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information credential fields within config.json via the System Console UI...

Mattermost Server is vulnerable to Code Injection through its LDAP fields

An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection...

Cross-site Scripting (XSS)

Overview github.com/mattermost/mattermost-server is an open source Slack-alternative in Golang and React. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the lack of noreferrer and noopener link relationship attributes. An attacker can execute arbitrary scripts in...

GHSA-9W4V-9C99-HV7R Mattermost Server exposes sensitive information via its System Console UI

An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information credential fields within config.json via the System Console UI...

GHSA-7VMW-6C7H-RRRV Mattermost Server is vulnerable to Code Injection through its LDAP fields

An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection...

Mattermost Server does not check if cookies are used over SSL

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

Mattermost Server: Insufficient Password-Reset Link Invalidation

An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...

Mattermost Server is vulnerable to XSS through customizable theme color-code values

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values...

Mattermost Server vulnerable to Cross-site Scripting through file preview feature

An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview...

GHSA-CFFJ-7W5C-JQJH Mattermost Server vulnerable to Cross-site Scripting through file preview feature

An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview...

Mattermost Server Buffer Overflow Vulnerability (CNVD-2022-65355)

Mattermost Server is an open source messaging platform from Mattermost, Inc. A buffer overflow vulnerability exists in Mattermost Server versions 6.3.2 and below, which stems from the fact that Mattermost Server's document extractor does not properly validate data boundaries when performing...

CVE-2022-0903

A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body...