FreeBSD : Gitlab -- multiple vulnerabilities (085a087b-3897-11e8-ac53-d8cb8abf62dd)

GitLab reports : Confidential issue comments in Slack, Mattermost, and webhook integrations. Persistent XSS in milestones data-milestone-id. Persistent XSS in filename of merge request. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

Uber: [uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.

Vulnerability description not provided...

Mattermost Cross-Site Scripting Vulnerability

Mattermost is an open source alternative to Slack.Developed in the Go language, Mattermost is an open source team communication service. Mattermost suffers from a cross-site scripting vulnerability that can be exploited by unauthenticated attackers to trigger cross-site attacks...

Cross-site Scripting (XSS)

Mattermost is vulnerable to cross-site scripting XSS. It does not properly validate and sanitize user-supplied input to the HTTP GET parameter link in "/error" page. It is possible to set the return link, which is part of the error page, to a base64 encoded DATA URI. This could be used to execute...

Mattermost 3.5.0 / 3.5.1 Cross Site Scripting Vulnerability

Mattermost versions 3.5.0 and 3.5.1 suffer from a cross site scripting vulnerability. 1. ADVISORY INFORMATION ======================= Product: Mattermost Vendor URL: www.mattermost.org Type: Cross-site Scripting CWE-79 Date found: 02/12/2016 Date published: 16/01/2017 CVSSv3 Score: 4.7...

Mattermost 3.5.0 / 3.5.1 Cross Site Scripting

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Mattermost Vendor URL: www.mattermost.org Type: Cross-site Scripting CWE-79 Date found: 02/12/2016 Date published: 16/01/2017 CVSSv3 Score: 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N...