1648 matches found
Code injection
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens...
CVE-2017-18909
Mattermost Server before 3.9.0 with SAML enabled is affected. The root cause is that encryption and signature verification are not mandatory in the SAML flow, which can weaken protection of SAML data. Affected product: Mattermost Server (pre-3.9.0). No explicit exploit details, mitigation steps, ...
CVE-2017-18909
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory...
CVE-2017-18910
Mattermost Server prior to versions 3.8.2, 3.7.5, and 3.6.7 contains an issue where email notifications can include spoofed links. The Red Hat, CNVD, NVD, OSV, and CVE listings corroborate the same vulnerability across multiple vendors and feeds. The available documents specify affected versions ...
CVE-2017-18910
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links...
CVE-2017-18911
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server...
CVE-2017-18912
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file...
CVE-2017-18904
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file...
CVE-2017-18904
Mattermost Server prior to 4.0.0, 3.10.2, and 3.9.2 is vulnerable to XSS via an uploaded file. The issue is documented across multiple feeds (NVD, Red Hat, SUSE, OSV, GHSA) with the same basic description: uploaded-file handling allows cross-site scripting. No explicit remediation version is stat...
CVE-2017-18903
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled...
CVE-2017-18898
CVE-2017-18898 affects Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. The issue allows crafted posts that can cause a web browser to hang, constituting a DoS condition. Supported Connected documents (e.g., SUSE/Red Hat/GHSA entries, OSV) reiterate the same description. The provided sources do ...
CVE-2017-18900
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report...
CVE-2017-18886
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...
CVE-2017-18880
Mattermost Server vulnerable to cross-site scripting (XSS) via the title_link field of a Slack attachment in versions prior to 4.3.0, 4.2.1, and 4.1.2. Connected documents confirm the same description; no exploitation details or fixes are provided in the available sources. Action: monitor for upd...
CVE-2017-18899
Mattermost Server prior to 4.2.0, 4.1.1, and 4.0.5 is affected by an issue where IP-based rate limiting is mishandled. This could lead to improper request throttling and potential availability impact as indicated by the CVE description. Affected component: Mattermost Server (versions before 4.2.0...
CVE-2017-18899
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting...
CVE-2018-21252
An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups...
CVE-2017-18873
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service channel invisibility via a misformatted post...