BIT-MATTERMOST-2023-2515

Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin...

BIT-MATTERMOST-2023-4478

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts...

CVE-2024-22699

FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/admin/updategroupsave...

CVE-2024-22593

FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/admin/addgroupsave...

Cross site request forgery (csrf)

FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/admin/addgroupsave...

CVE-2024-22593: Cross-Site Request Forgery (CSRF)

FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/admin/addgroupsave...

CVE-2024-22699: Cross-Site Request Forgery (CSRF)

FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/admin/updategroupsave...

CVE-2023-4478

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts...

CVE-2023-4478 Parameter tampering in the registration resulting in blocked accounts to be created

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts...

CVE-2023-4478

Mattermost is affected by CVE-2023-4478 due to improper handling of signup request parameters, allowing an attacker to register users as inactive and thereby block future access unless an admin activates the accounts. The issue stems from the system’s failure to restrict which request parameters ...

Incorrect Authorization

github.com/mattermost/mattermost-server is vulnerable to Incorrect Authorization. The vulnerability exists because the library does not properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first...

Code injection

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...

CVE-2023-4107

Mattermost: Incorrect authorization allows a user manager to update a system admin’s details (email, first name, last name) due to inadequate permission checks. Affects Mattermost server implementations documented across Red Hat, EUVD/ENISA, VERACODE, OSV, GHSA and NVD entries. The issue is descr...

CVE-2023-4107 Incorrect authorization allows a user manager to update a system admin

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...

CVE-2023-4107 Incorrect authorization allows a user manager to update a system admin

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...

CVE-2023-4107: Incorrect Authorization

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name...

PT-2023-26070 · Unknown · Online Nurse Hiring System

Name of the Vulnerable Software and Affected Versions: Online Nurse Hiring System version 1.0 Description: The issue is related to a cross-site scripting XSS vulnerability found in the Profile Page of the Admin section. This type of vulnerability allows attackers to inject malicious scripts into...

CVE-2023-3587 Inconsistent state in UI after boards permission change by system admin

Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions...

CVE-2023-3587 Inconsistent state in UI after boards permission change by system admin

Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions...

CVE-2023-3587 Inconsistent state in UI after boards permission change by system admin

Mattermost fails to properly show information in the UI, allowing a system admin to modify a board state allowing any user with a valid sharing link to join the board with editor access, without the UI showing the updated permissions...