1648 matches found
CVE-2017-18878
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session...
CVE-2017-18878
Mattermost Server contains a session-id leakage vulnerability affecting versions before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a valid session ID allows an attacker to revoke another user’s session. This is documented across multiple sources (e.g., Red Hat, SUSE, GHSA advisories) and is not tied t...
CVE-2017-18874
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal...
CVE-2017-18874
Mattermost Server has a directory traversal vulnerability when local storage for files is used, affecting versions prior to 4.3.0, 4.2.1, and 4.1.2. A System Admin can achieve the traversal through local file storage handling. Remediation: upgrade to Mattermost Server 4.3.0 or later (or apply ven...
CVE-2017-18873
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service channel invisibility via a misformatted post...
CVE-2017-18872
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...
CVE-2017-18872
Mattermost Server, prior to version 4.4.3 and 4.3.3, is affected. In these releases, when Mattermost operates as an OAuth 2.0 service provider, an issue could allow attackers to reconfigure an OAuth app in some scenarios. The vulnerability centers on the OAuth app configuration within mattermost-...
CVE-2018-21252
An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups...
CVE-2018-21252
CVE-2018-21252 affects Mattermost Server prior to 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could bypass domain-based signup policies by using multiple email addresses. The provided connected documents confirm affected versions and the bypass behavior; no remediation or exploitation details are in...
CVE-2018-21256
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions for group-message channel creation via the Group message slash command...
CVE-2019-20889
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation...
CVE-2019-20890
An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions...
CVE-2019-20889
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation...
CVE-2019-20890
An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions...
CVE-2019-20885
An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file...
CVE-2019-20885
An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file...
CVE-2019-20878
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled...
CVE-2019-20877
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled...