109 matches found
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient restriction of the groupconstrained channel flag in the channel patch API. An attacker can remove all participants from a group or direct message conversation by enabling the groupconstrained fl...
Authentication Bypass by Primary Weakness
Overview github.com/mattermost/mattermost/server/v8/channels/api4 is a platform for secure collaboration across the entire software development lifecycle Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the magic-link token authentication process. A...
Improper Neutralization
Overview Affected versions of this package are vulnerable to Improper Neutralization via the mmctl component. An attacker can execute arbitrary terminal escape sequences by sending specially crafted messages, potentially leading to manipulation of administrator terminals, including screen...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the channel search API endpoint. An attacker can access information about all public channels within a private team by querying the API after being removed from the team. Remediation Upgrade...
CVE-2024-39274
Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to properly validate that the channel that comes from the sync message is a shared channel, when shared channels are enabled, which allows a malicious remote to add users to arbitrary teams and channels...
CVE-2024-2450
Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownership when switching from email to SAML authentication, allowing an authenticated attacker to take over other user accounts via a crafted switch request und...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization due to improper enforcement of the Allow users to view archived channels setting in the threads interface. An attacker can gain unauthorized access to archived channel content and files by using the "Open in...
EUVD-2021-24339
Malware in sbrugna...
EUVD-2023-58777
Malicious code in bioql PyPI...
EUVD-2024-0766
Malicious code in bioql PyPI...
EUVD-2025-12103
Malicious code in bioql PyPI...
EUVD-2025-6721
Malicious code in bioql PyPI...
EUVD-2022-34669
Malicious code in bioql PyPI...
EUVD-2022-34671
Malicious code in bioql PyPI...
EUVD-2023-0969
Malicious code in bioql PyPI...
EUVD-2023-33708
Malicious code in bioql PyPI...
EUVD-2023-34248
Malicious code in bioql PyPI...
EUVD-2023-44232
Malicious code in bioql PyPI...