7510 matches found
CVE-2019-20866
An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled...
CVE-2019-20866
CVE-2019-20866 affects Mattermost Server prior to 5.12.0. The root cause is the mishandling of IP address information by using a Proxy HTTP header instead of the source address in the IP header. Impact per sources: partial confidentiality exposure of IPs. Exploitation details are not provided in ...
CVE-2019-20865
An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF...
CVE-2019-20865
Mattermost Server is affected by CVE-2019-20865 (login page CSRF) for versions before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The connected Red Hat and CVE sources confirm the CSRF issue on the login page across these releases. The documents do not provide further technical details, exploitat...
CVE-2019-20864
Mattermost Plugins (prior to 5.13.0) are affected by CVE-2019-20864. The GitHub plugin allows an attacker to attach their Mattermost account to another user’s GitHub account, enabling account association manipulation. Documented impact and scope: authenticated or unauthenticated exploitation is n...
CVE-2019-20864
An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitHub account...
CVE-2019-20863
An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted...
CVE-2019-20863
CVE-2019-20863 affects Mattermost Server prior to 5.13.0, where incoming webhook creation is not properly restricted. This is a usability/authorization flaw in webhook provisioning that could enable misconfiguration or abuse by an attacker with access to create webhooks. The available documents c...
CVE-2019-20862
Mattermost Server before 5.13.0 is affected by CVE-2019-20862: non-members may fetch a team's slash commands. The connected sources confirm the affected product and impact description but do not provide root-cause details or a formal remediation/patch version. No exploitation specifics are includ...
CVE-2019-20862
An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands...
CVE-2019-20861
An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link...
CVE-2019-20861
The vulnerability CVE-2019-20861 affects Mattermost Desktop App prior to 4.2.2. A crafted link can allow an attacker to execute arbitrary code. The provided documents confirm the affected product/version and the high-level impact but do not include details on root cause, specific vulnerable compo...
CVE-2020-14460
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...
CVE-2020-14460
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...
CVE-2020-14451
An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013...
CVE-2020-14456
An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006...
CVE-2020-14457
An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the updateteam WebSocket event, aka MMSA-2020-0012...
CVE-2020-14455
An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007...