Code injection

An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0020...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002...

CVE-2019-20844

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel...

CVE-2019-20844

The CVE-2019-20844 entry applies to Mattermost Server when using versions before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. The documented issue is that an attacker can spoof a direct-message channel by changing the type of a channel. The available sources confirm the affected software and the mi...

CVE-2020-14459

CVE-2020-14459 affects Mattermost Server prior to 5.19.0. The vulnerability allows attackers to rename a channel and cause a collision with a direct message, described across multiple sources (e.g., PT‑2020‑14019). Impact is the potential confusion or misrouting between channel and direct message...

CVE-2020-14459: Improper Input Validation

An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002...

CVE-2019-20844: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel...

CVE-2018-21254: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...

CVE-2020-14448: Loop with Unreachable Exit Condition

An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0020...

X (Formerly Twitter): Delete direct message history without access the proper conversation_id

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: add summary of the vulnerabili...

X (Formerly Twitter): Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter App

Summary: Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter App Description: Because very long links in direct messages are truncated after 38 characters the malicious actors were able to provide a...

Slack: "a stored xss issue in share post menu"

good day: when a team mate named an xss payload: ex: " " that xss payload will execute when making a post then share it, to a team that has an xss payload named. that shared as a direct message please see screenshot when making post here: https://hunter22.slack.com/files/create/space...

Twitter warning, Do not click DM saying "My profile was viewed..times..today"

A very quick and urgent warning for Twitter users, If you receive a direct message DM on Twitter saying "My profile was viewed..times..today" with a link then please don't click it. If you do, you will run the risk of having your Twitter account hijacked, your account turned into a spam-spewing...