1648 matches found
CVE-2017-18919
An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation...
CVE-2017-18918
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname...
CVE-2017-18918
CVE-2017-18918 affects Mattermost Server prior to 3.7.3 and 3.6.5. The issue allows a System Administrator to place a SAML certificate at an arbitrary pathname. Connected documents also reiterate the same description. No further technical details (root cause, exploit status, mitigations, or affec...
CVE-2017-18907
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header...
CVE-2017-18907
Mattermost Server versions before 4.0.0, 3.10.2, and 3.9.2 are affected by a cross-site scripting (XSS) vulnerability that can be triggered via a channel header . The available documents describe the issue but do not disclose the exact root cause details beyond the header-based vector, nor provid...
CVE-2017-18916
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction...
CVE-2017-18916
Mattermost Server contains an API endpoint access control vulnerability. Affected versions are Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The root cause is that API endpoint access control does not honor an integration permission restriction, potentially allowing improper access to integra...
CVE-2017-18917
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens...
CVE-2017-18906
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...
CVE-2017-18906
Summary: Mattermost Server versions before 4.0.0, 3.10.2, and 3.9.2 are affected by a vulnerability in Single Sign-On OAuth2 that could allow an attacker to claim another user’s account. The connected Red Hat, OSV, CNVD, and NVD references corroborate the issue; however, the provided documents do...
CVE-2017-18913
Mattermost Server pre-3.8.2, 3.7.5, and 3.6.7 is affected by an XSS vulnerability that can be triggered via a link on an error page. The issue is documented across multiple feeds (NVD and vendor mirrors) with the same basic description, but the connected materials do not provide details on the ro...
CVE-2017-18908
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address...
CVE-2017-18914
Mattermost Server prior to 3.8.2, and also affected branches 3.7.5 and 3.6.7, contains a flaw where an external link can appear on an error page even if not on the allowlist. There are no exploitation details provided in the documents. Impact is limited to incorrect external link rendering on err...
CVE-2017-18914
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist...
CVE-2017-18904
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file...
CVE-2017-18909
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory...
CVE-2017-18910
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links...
CVE-2017-18912
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file...