CVE-2019-20863

An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted...

CVE-2020-14447

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

Denial of service

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

CVE-2020-14447

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

CVE-2020-14447

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

PT-2020-8416

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.5.0 Mattermost Server version 4.4.5 Mattermost Server version 4.3.4 Description: The issue concerns the mishandling of webhook access control in the EnableOnlyAdminIntegrations case. Recommendations: For...

CVE-2017-18870: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case...

CVE-2019-20888: Missing Release of Memory after Effective Lifetime

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...

CVE-2019-20863: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted...

CVE-2020-14447: Loop with Unreachable Exit Condition

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

PT-2020-10826

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.13.0 Description An issue was discovered where incoming webhook creation is not properly restricted. Recommendations For versions prior to 5.13.0, update to version 5.13.0 or later to resolve the issue...

PT-2020-10852

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.7 Mattermost Server version 5.6.3 and earlier Mattermost Server version 5.5.2 and earlier Mattermost Server version 4.10.5 and earlier Description An issue in Mattermost Server allows attackers to cause a...

PT-2020-14007 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.23.0 Description: An issue allows attackers to cause a denial of service infinite loop by sending large webhook requests. Recommendations: For versions prior to 5.23.0, update to version 5.23.0 or later t...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +31303 more potentially affected by CVE-2020-14060 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-14060 Source advisory:...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +31303 more potentially affected by CVE-2020-14060 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-14060 Source advisory:...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +31303 more potentially affected by CVE-2020-14062 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.4)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-14062 Source advisory:...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +30952 more potentially affected by CVE-2020-11113 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.3)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-11113 Source advisory:...

aero.champ:cargojson (1.0), ai.active:webhook-sdk (>=1.0.0, <=1.0.4) +30952 more potentially affected by CVE-2020-11620 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0, <=2.9.10.3)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =local, =thread-pool-0.0.24-dev, =local, =0.0.12, =0.0.12, =0.1.2, =0.1.7 and more Source cves: CVE-2020-11620 Source advisory:...

Citrix XenMobile Server 10.8 XML Injection

Exploit Title: Citrix XenMobile Server 10.8 - XML External Entity Injection Google Dork: inurl:zdm logon Date: 2019-11-28 Exploit Author: Jonas Lejon Vendor Homepage: https://www.citrix.com Software Link: Version: XenMobile Server 10.8 before RP2 and 10.7 before RP3 Tested on: XenMobile CVE :...

Citrix XenMobile Server 10.8 - XML External Entity Injection

Citrix XenMobile Server 10.8 - XML External Entity Injection Exploit Title: Citrix XenMobile Server 10.8 - XML External Entity Injection Google Dork: inurl:zdm logon Date: 2019-11-28 Exploit Author: Jonas Lejon Vendor Homepage: https://www.citrix.com Software Link: Version: XenMobile Server 10.8...