959 matches found
CVE-2017-18880
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the titlelink field of a Slack attachment...
CVE-2022-0124
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack...
CVE-2022-31162
Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive...
Improper Authentication
github.com/mattermost/mattermost-server is vulnerable to improper authentication. The vulnerability is due to failure to validate email ownership during the Slack import process, which allows an attacker to create verified user accounts with arbitrary email domains and bypass email-based team...
SUSE CVE-2017-18879
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the authorlink field of a Slack attachment...
Information Leakage in Grafana Alerting
In Grafana’s alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notifications:write” or “alert.notifications.receivers:test” that are granted as part of the fixed role “Contact Point Writer”, which is part of the basic role Editor - can edit...
GO-2025-4189 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments in github.com/mattermost/mattermost-server
Mattermost Server is vulnerable to XSS through authorlink field in Slack attachments in github.com/mattermost/mattermost-server...
SUSE CVE-2025-41410
Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictio...
Hackers Steal Personal Data and 17K Slack Messages in Nikkei Data Breach
Nikkei confirms breach after a virus infected an employee PC, exposing 17,368 names and Slack chat histories. The media giant reported the incident voluntarily...
GO-2025-4068 Slack Nebula may accept arbitrary source IP addresses in github.com/slackhq/nebula
Slack Nebula may accept arbitrary source IP addresses in github.com/slackhq/nebula...
Mattermost Server 10.5.x < 10.5.11 / 10.10.x < 10.10.3 / 10.11.x 10.11.3 / 10.12.0 Missing Authorization (MMSA-2025-00525)
The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2025-00525 advisory. - Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows...
CVE-2025-62820
A flaw was found in Slack Nebula. An improper CIDR construction in the hostmap logic makes the inbound firewall overly permissive for nodes with certificates allowing subnets or multiple IPs. An attacker controlling such a node can send packets with arbitrary source IP addresses within the networ...
Slack Nebula may accept arbitrary source IP addresses
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network...
CVE-2025-62820
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network...
CVE-2025-62820
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network...
CVE-2025-62820
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network...
CVE-2025-62820
Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network...
Slack Nebula 安全漏洞
Slack Nebula is a scalable overlay network tool from Slack open source. A security vulnerability exists in Slack Nebula versions prior to 1.9.7 that stems from improper CIDR handling in certain configurations, which could lead to the acceptance of arbitrary source IP addresses in the Nebula netwo...
CVE-2025-62820
Slack Nebula prior to 1.9.7 is affected by a CIDR handling issue that allows accepting arbitrary source IPs within the Nebula network. The CVE entry documents this as a network‑level vulnerability with a CVSS v3.1 base score of 4.9 (Medium) and a high attack complexity, requiring low privileges a...
