CVE-2017-18879

Mattermost Server is affected by an XSS vulnerability via the author_link field in Slack attachments. Exploitation targets versions before 4.3.0, 4.2.1, and 4.1.2. Root cause: improper handling of Slack attachment author_link content leading to script execution. Remediation: upgrade to Mattermost...

CVE-2019-20884

An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post...

CVE-2019-20884

An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post...

CVE-2019-20884

An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post...

CVE-2019-20884

Mattermost Server prior to 5.8.0 has a vulnerability that allows attackers to partially attach a file to more than one post. The connected documents confirm the issue and the affected version range, but no concrete root-cause, exploit details, or mitigation steps are provided in the texts. Remedi...

CVE-2019-20855

An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information local files during legacy attachment migration...

CVE-2019-20855

An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information local files during legacy attachment migration...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information local files during legacy attachment migration...

CVE-2019-20864

An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitHub account...

CVE-2019-20855

An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information local files during legacy attachment migration...

CVE-2019-20855

Mattermost Server contains an information disclosure flaw in legacy attachment migration affecting versions before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. The issue allows an attacker to obtain sensitive local files due to improper handling during migration. The connected documents confirm the affecte...

Mail.ru: Stored XSS that allow an attacker to read victim mailboxes contacts in mail.ru and my.com application

Mail.ru Mail IOS app was vulnerable to local files access on some iOS versions due to cross-application scripting if malcrafted SVG attachment is viewed by user Write-up is here...

Rocket.Chat: XSS in message attachment fileds.

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Summary: There is a...

Updated roundcubemail packages fix security vulnerability

The latest maintenance release of roundcubemail fixes some xss issues: - Fix XSS issue in template object 'username' - Fix cross-site scripting XSS via malicious XML attachment and improves the fix for CVE-2020-12641...

MGASA-2020-0261 Updated roundcubemail packages fix security vulnerability

The latest maintenance release of roundcubemail fixes some xss issues: - Fix XSS issue in template object 'username' - Fix cross-site scripting XSS via malicious XML attachment and improves the fix for CVE-2020-12641...

Arbitrary File Write

php-ews/php-ews is vulnerable to arbitrary file write. The vulnerability allows a malicious user to overwrite arbitrary files by sending a message containing an attachment with filename foo/../../../../../etc/passwd...

PHPMailer < 6.1.6 Output Escaping Vulnerability

PHPMailer contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be...

CVE-2020-4047 Authenticated XSS via media attachment page in WordPress

In affected versions of WordPress, authenticated users with upload permissions like authors are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has...

Debian DLA-2244-1 : libphp-phpmailer security update

It was discovered that there was an escaping issue in libphp-phpmailer, an email generation utility class for the PHP programming language. The Content-Type and Content-Disposition headers could have permitted file attachments that bypassed attachment filters which match on filename extensions. F...