1648 matches found
Design/Logic Flaw
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place...
Crlf injection
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens...
CVE-2015-9548
CVE-2015-9548 affects Mattermost Server prior to 1.2.0. The issue allows attackers to cause a denial of service via a small compressed file that expands to a large size in memory, leading to memory consumption. The CVSS vectors indicate a network-based attack with low complexity and no authentica...
CVE-2015-9548
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service memory consumption via a small compressed file that has a large size when uncompressed...
CVE-2016-11084
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...
CVE-2016-11083
CVE-2016-11083 affects Mattermost Server prior to 2.2.0. The issue enables cross-site scripting (XSS) by configuring files to be opened in a browser window, allowing embedded scripts to run under certain conditions. The vulnerability originates from how files are rendered, not from external input...
CVE-2016-11083
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...
CVE-2016-11082
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link...
CVE-2016-11081
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser...
CVE-2016-11080
Mattermost Server (Mattermost Server) before version 3.0.0 contains a vulnerability where a Team Administrator can access superfluous APIs to view account details. Affected component: server-side API exposing account data to higher-privilege users. Root cause: insufficient access control on accou...
CVE-2016-11080
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details...
CVE-2016-11079
Mattermost Server (github.com/mattermost/mattermost-server) contains an XSS flaw via the redirect URL in versions before 3.0.0. The root cause is improper handling/validation of the redirect URL parameter. Impact: attacker-supplied redirect can execute scripts in a user’s browser. Remediation: up...
CVE-2016-11079
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL...
CVE-2016-11078
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information credential fields within config.json via the System Console UI...
CVE-2016-11077
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account...
CVE-2016-11076
Summary: Mattermost Server prior to 3.0.0 does not ensure cookies are transmitted over SSL. This is the root cause described consistently across CVE-2016-11076 references (NVD, Red Hat, SUSE, osv.dev). The connected documents confirm the same issue; no public exploit details or remediation steps ...