7512 matches found
CVE-2017-18885
Mattermost Server vulnerability CVE-2017-18885 affects Mattermost Server versions prior to 4.3.0, 4.2.1, and 4.1.2. An attacker can gain privileges by accessing unintended API endpoints on a user’s behalf. Root cause is exposure of endpoints that can be invoked with a user’s credentials to perfor...
CVE-2017-18901
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document...
CVE-2017-18901
Mattermost Server contains an information-disclosure issue (CVE-2017-18901) where an attacker can discover a private team invite ID by requesting a JSON document. Affected versions: Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. Root cause: exposure of invite identifiers through a JSON fetch....
CVE-2017-18889
Summary: CVE-2017-18889 affects Mattermost Server prior to 4.3.0, 4.2.1, and 4.1.2. An attacker can abuse the v3/v4 REST API via webhooks or slash commands to create fictive system-message posts. What’s affected: Mattermost Server (versions before 4.3.0, 4.2.1, and 4.1.2). The vulnerability is ex...
CVE-2017-18889
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...
CVE-2017-18890
CVE-2017-18890 affects Mattermost Server prior to 4.3.0, 4.2.1, and 4.1.2. An attacker can craft a UI button that, when pressed by a user, triggers an API request. The vulnerability description across Red Hat/SUSE/SUSCVE and OSV confirms the same behavior and impact. Remediation guidance in sourc...
CVE-2017-18890
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request...
CVE-2017-18892
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized...
CVE-2017-18892
CVE-2017-18892 affects Mattermost Server prior to 4.2.0, 4.1.1, and 4.0.5, where an Email template field can contain HTML content that is not neutralized, enabling potential HTML/Script injection via that field. Remediation: upgrade to Mattermost versions 4.0.5-rc1, 4.1.1-rc1, 4.2.0-rc3 or newer....
CVE-2017-18891
Mattermost Server prior to 4.2.0, 4.1.1, and 4.0.5 is affected by a phishing vulnerability where an error page can contain a link that misleads users. Root cause per available descriptions is insufficient protection around error pages, enabling potential credential or data exposure via user inter...
CVE-2017-18891
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link...
CVE-2017-18884
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens...
CVE-2017-18884
Mattermost Server versions before 4.3.0, 4.2.1, and 4.1.2 are affected by an authorization issue where an attacker can gain privileges by abusing a registered OAuth application with personal access tokens. The connected documents consistently describe this specific vector and the vulnerable compo...
CVE-2017-18883
The CVE-2017-18883 entry concerns Mattermost Server versions prior to 4.3.0, 4.2.1, and 4.1.2 when acting as an OAuth 2.0 Service Provider. The underlying issue is low entropy for authorization data, as described in Red Hat, SUSE, and other connected sources. The affected component is the OAuth 2...
CVE-2017-18883
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...
CVE-2017-18882
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data...
CVE-2017-18882
Mattermost Server contains a cross-site scripting (XSS) vulnerability (CVE-2017-18882) affecting versions prior to 4.3.0, 4.2.1, and 4.1.2. Descriptions across sources attribute the issue to improper handling/validation of OpenGraph data supplied by the user, enabling an attacker to inject and ex...
CVE-2017-18881
Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 is affected by CVE-2017-18881, which allows cross-site scripting via a goto_location response to a slash command. The issue arises from how the web application handles the goto_location response and could permit injection of script in affected web ...