1648 matches found
Cross site request forgery (csrf)
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header...
Cross site scripting
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy...
Code injection
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service memory consumption via a small compressed file that has a large size when uncompressed...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance...
Information disclosure
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...
Cross site scripting
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link...
Information disclosure
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API...
Cross site scripting
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting...
Code injection
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details...
Code injection
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page...
Code injection
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values...
Cross site scripting
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname...