7519 matches found
CVE-2017-18883
The CVE-2017-18883 entry concerns Mattermost Server versions prior to 4.3.0, 4.2.1, and 4.1.2 when acting as an OAuth 2.0 Service Provider. The underlying issue is low entropy for authorization data, as described in Red Hat, SUSE, and other connected sources. The affected component is the OAuth 2...
CVE-2017-18883
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...
CVE-2017-18882
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data...
CVE-2017-18882
Mattermost Server contains a cross-site scripting (XSS) vulnerability (CVE-2017-18882) affecting versions prior to 4.3.0, 4.2.1, and 4.1.2. Descriptions across sources attribute the issue to improper handling/validation of OpenGraph data supplied by the user, enabling an attacker to inject and ex...
CVE-2017-18881
Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 is affected by CVE-2017-18881, which allows cross-site scripting via a goto_location response to a slash command. The issue arises from how the web application handles the goto_location response and could permit injection of script in affected web ...
CVE-2017-18881
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a gotolocation response to a slash command...
CVE-2017-18879
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the authorlink field of a Slack attachment...
CVE-2017-18879
Mattermost Server is affected by an XSS vulnerability via the author_link field in Slack attachments. Exploitation targets versions before 4.3.0, 4.2.1, and 4.1.2. Root cause: improper handling of Slack attachment author_link content leading to script execution. Remediation: upgrade to Mattermost...
CVE-2017-18878
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session...
CVE-2017-18878
Mattermost Server contains a session-id leakage vulnerability affecting versions before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a valid session ID allows an attacker to revoke another user’s session. This is documented across multiple sources (e.g., Red Hat, SUSE, GHSA advisories) and is not tied t...
CVE-2017-18874
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal...
CVE-2017-18874
Mattermost Server has a directory traversal vulnerability when local storage for files is used, affecting versions prior to 4.3.0, 4.2.1, and 4.1.2. A System Admin can achieve the traversal through local file storage handling. Remediation: upgrade to Mattermost Server 4.3.0 or later (or apply ven...
CVE-2017-18873
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service channel invisibility via a misformatted post...
CVE-2017-18873
Mattermost Server suffers a denial-of-service vulnerability (channel invisibility) caused by misformatted posts in versions prior to 4.3.0, 4.2.1, and 4.1.2. Root cause: improper handling of misformatted posts. Impact stated as DoS/channel invisibility; exploitation details are not provided in th...
CVE-2017-18872
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...
CVE-2017-18872
Mattermost Server, prior to version 4.4.3 and 4.3.3, is affected. In these releases, when Mattermost operates as an OAuth 2.0 service provider, an issue could allow attackers to reconfigure an OAuth app in some scenarios. The vulnerability centers on the OAuth app configuration within mattermost-...
CVE-2018-21252
An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups...
CVE-2018-21252
CVE-2018-21252 affects Mattermost Server prior to 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could bypass domain-based signup policies by using multiple email addresses. The provided connected documents confirm affected versions and the bypass behavior; no remediation or exploitation details are in...
CVE-2018-21256
Mattermost Server before 5.1 contains CVE-2018-21256, where the Group message slash command can bypass intended access restrictions for creating group-message channels. The issue is described consistently across multiple sources (NVD, Red Hat, CNVD, OSV, CVE entries). The available documents do n...