2447 matches found
Incorrect Implementation of Authentication Algorithm
Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to persisting authentication data in a cache when performing ConvertUserToBot. A user who...
Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems
Cybersecurity researchers have uncovered three malicious packages in the npm registry that masquerade as a popular Telegram bot library but harbor SSH backdoors and data exfiltration capabilities. The packages in question are listed below - node-telegram-utils 132 downloads node-telegram-bots-api...
Khan Academy: Leaked reused password for a few Khan Academy users
A large number of Khan Academy user credentials, including emails and passwords, were exposed through a Telegram bot. The exact source of the leaked data is unknown, but the volume of exposed information was substantial...
Unmasking the new XorDDoS controller and infrastructure
Cisco Talos observed an existing distributed denial-of-service DDoS malware known as XorDDoS, continuing to spread globally between November 2023 and February 2025. A significant finding shows that over 70 percent of attacks using XorDDoS targeted the United States from Nov. 2023 to Feb. 2025. Th...
CVE-2025-2475
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials...
CVE-2025-24839 Unauthorized AI bot activation via Wrangler plugin
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activateai override property to a post via the Wrangler plugin, provided...
CVE-2025-24839
Mattermost CVE-2025-24839 affects Mattermost Server 9.11.x <= 9.11.9, 10.4.x <= 10.4.3, and 10.5.x
CVE-2025-24839 Unauthorized AI bot activation via Wrangler plugin
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activateai override property to a post via the Wrangler plugin, provided...
2025 Imperva Bad Bot Report: How AI is Supercharging the Bot Threat
Bad bots continue to target organizations across every industry and geography, but the rise of Artificial Intelligence AI is fueling bot attacks, making them more intelligent and more evasive than ever before. For over twelve years, Imperva has been dedicated to helping organizations manage and...
Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials...
GHSA-6RQH-8465-2XCW Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials...
CVE-2025-2475
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials...
CVE-2025-2475 Unauthorized Bot Login Using Credentials
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials...
CVE-2025-2475
Mattermost CVE-2025-2475 affects servers 9.11.x up to 9.11.9, 10.4.x up to 10.4.3, and 10.5.x up to 10.5.1. The root cause is a failure to invalidate the cache when a user account is converted to a bot, enabling an attacker to log in to the bot exactly once using normal credentials. The available...
CVE-2025-2475 Unauthorized Bot Login Using Credentials
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials...
CVE-2025-2475 Unauthorized Bot Login Using Credentials
Mattermost versions 10.5.x = 10.5.1, 10.4.x = 10.4.3, 9.11.x = 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials...
PT-2025-16246 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.9 Mattermost versions 10.4.x through 10.4.3 Mattermost versions 10.5.x through 10.5.1 Description: The issue arises when a user account is converted to a bot, and the cache is not properly invalidated,...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost versions 10.5.1 and prior 10.5.x, 10.4.3 and prior 10.4.x, and 9.11.9 and prior 9.11.x, which stems from an uninvalidated cache and could lead to an attack...
