CVE-2019-1003026

A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message...

CVE-2019-1003026

A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message...

CVE-2019-1003026

A server-side request forgery vulnerability exists in Jenkins Mattermost Notification Plugin 2.6.2 and earlier in MattermostNotifier.java that allows attackers with Overall/Read permission to have Jenkins connect to an attacker-specified Mattermost server and room and send a message...

CVE-2019-1003026

The CVE describes a server-side request forgery in Jenkins Mattermost Notification Plugin (MattermostNotifier.java) affecting versions up to and including 2.6.2. The root cause is a lack of privilege checks that allows attackers with Overall/Read permission to instruct Jenkins to connect to an at...

PT-2019-11323 · Jenkins · Jenkins Mattermost Notification Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Mattermost Notification Plugin versions 2.6.2 and earlier Description: A server-side request forgery issue exists that allows attackers with Overall/Read permission to have the system connect to an attacker-specified server and room a...

Mattermost Server Detection (HTTP)

HTTP based detection of Mattermost Server. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.108464...

FreeBSD : Gitlab -- multiple vulnerabilities (9dfe61c8-4d15-11e8-8f2f-d8cb8abf62dd)

GitLab reports : Persistent XSS in Move Issue using project namespace Download Archive allowing unauthorized private repo access Mattermost Updates C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright...

Gitlab -- multiple vulnerabilities

GitLab reports: Persistent XSS in Move Issue using project namespace Download Archive allowing unauthorized private repo access Mattermost Updates...

FreeBSD : Gitlab -- multiple vulnerabilities (085a087b-3897-11e8-ac53-d8cb8abf62dd)

GitLab reports : Confidential issue comments in Slack, Mattermost, and webhook integrations. Persistent XSS in milestones data-milestone-id. Persistent XSS in filename of merge request. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

Uber: [uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.

Vulnerability description not provided...

Mattermost Cross-Site Scripting Vulnerability

Mattermost is an open source alternative to Slack.Developed in the Go language, Mattermost is an open source team communication service. Mattermost suffers from a cross-site scripting vulnerability that can be exploited by unauthenticated attackers to trigger cross-site attacks...

Cross-site Scripting (XSS)

Mattermost is vulnerable to cross-site scripting XSS. It does not properly validate and sanitize user-supplied input to the HTTP GET parameter link in "/error" page. It is possible to set the return link, which is part of the error page, to a base64 encoded DATA URI. This could be used to execute...

Mattermost 3.5.0 / 3.5.1 Cross Site Scripting Vulnerability

Mattermost versions 3.5.0 and 3.5.1 suffer from a cross site scripting vulnerability. 1. ADVISORY INFORMATION ======================= Product: Mattermost Vendor URL: www.mattermost.org Type: Cross-site Scripting CWE-79 Date found: 02/12/2016 Date published: 16/01/2017 CVSSv3 Score: 4.7...

Mattermost 3.5.0 / 3.5.1 Cross Site Scripting

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Mattermost Vendor URL: www.mattermost.org Type: Cross-site Scripting CWE-79 Date found: 02/12/2016 Date published: 16/01/2017 CVSSv3 Score: 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N...