CVE-2016-11075

Mattermost Server

CVE-2016-11074

An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused...

CVE-2016-11073

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting...

CVE-2016-11072

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

CVE-2016-11071

Mattermost Server (before 3.1.0) is vulnerable to XSS via missing noreferrer and noopener link-rel protection. The root cause is failure to apply proper link relationship attributes, enabling malicious scripts when users click crafted links. Remediation: upgrade github.com/mattermost/mattermost-s...

CVE-2016-11070

Mattermost Server prior to version 3.1.0 is affected by an XSS vulnerability via theme color-code values. Root cause: improper handling/validation of user-provided theme color data that can be reflected in the client. Impact is documented as cross-site scripting with low to medium severity depend...

CVE-2016-11070

An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values...

CVE-2016-11069

Mattermost Server (before 3.2.0) contains a vulnerability in the password-change flow where brute-force attempts are mishandled, potentially enabling repeated password-change attempts. Affected product: Mattermost Server; initial description specifies 3.2.0 as the fixed version. Root cause: impro...

CVE-2016-11069

An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change...

CVE-2016-11068

An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection...

CVE-2016-11068

Mattermost Server prior to 3.2.0 is affected by an LDAP injection flaw that allows attackers to read LDAP fields. The issue is documented across multiple sources (NVD entry CVE-2016-11068, SUSE, Red Hat, OSV, and other feeds). The available descriptions consistently state that the vulnerability i...

CVE-2016-11067

An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang...

CVE-2016-11066

An issue was discovered in Mattermost Server before 3.2.0. The initialload API disclosed unnecessary personal information...

CVE-2016-11065

An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance...

CVE-2016-11065

Mattermost Server before 3.3.0 is affected. The vulnerability stems from the WebSocket feature allowing an attacker to send pop-up messages to users or alter a post’s appearance. The descriptions across connected documents confirm the affected software and the underlying impact, but do not specif...

CVE-2016-11063

An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview...

CVE-2016-11062

An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed...

CVE-2017-18920

An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy...

CVE-2017-18920

Mattermost Server ≤ 3.6.1 suffers a Same Origin Policy weakness in the WebSocket feature. The vulnerability context is limited to Mattermost Server prior to version 3.6.2; no exploitation details are provided in the sources. Mitigation guidance (from publicly available references) is to upgrade t...

CVE-2017-18919

Mattermost Server before 3.7.0 and 3.6.3 is affected: attackers can use the API to create teams without authentication, exposing an unauthorized team-creation path. No root cause or remediation details are provided in the connected documents.