1643 matches found
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the updateteam WebSocket event, aka MMSA-2020-0012...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002...
Type confusion
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel...
Code injection
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...
Directory traversal
An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014...
Code injection
An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service client-side, aka MMSA-2020-0017...
CVE-2019-20860
An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service application hang via a crafted SVG document...
CVE-2019-20859
Mattermost Server code path handling login can be bypassed by crafting input in versions prior to 5.15.0. This is reported across multiple sources (NVD entry CVE-2019-20859 and connected advisories), describing a login access control bypass issue. The documents identify the affected product and v...
CVE-2019-20858
An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service CPU consumption via crafted characters in a SQL LIKE clause to an APIv4 endpoint...
CVE-2019-20857
CVE-2019-20857 affects Mattermost Server prior to 5.16.0. The issue allows a denial of service by triggering a markdown renderer hang when processing many backtick characters. Multiple connected sources (Red Hat CVE entry, NVD entry, CNVD/EUVD mirrors, OSV, etc.) confirm the same description. No ...
CVE-2019-20857
An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service markdown renderer hang via many backtick characters...
CVE-2019-20855
An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information local files during legacy attachment migration...
CVE-2019-20855
Mattermost Server contains an information disclosure flaw in legacy attachment migration affecting versions before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. The issue allows an attacker to obtain sensitive local files due to improper handling during migration. The connected documents confirm the affecte...
CVE-2019-20854
An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service client-side application crash via a LaTeX message...
CVE-2019-20847
An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a usertyping WebSocket event to any channel...
CVE-2019-20847
Mattermost Server prior to version 5.18.0 is affected. A vulnerability allows an attacker to send a user_typing WebSocket event to any channel, indicating improper handling of WebSocket events. The issue is documented across multiple feeds (e.g., Red Hat advisory, CNVD) and is mitigated by updati...
CVE-2019-20846
An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage...
CVE-2019-20846
CVE-2019-20846 affects Mattermost Server before 5.18.0, with weak permissions for server-local file storage. The issue is described across multiple sources (NVD, Red Hat, OSV, CNVD) as a vulnerability with network access and high impact on confidentiality (CVSSv3.1: 7.5; AV:N/AC:L/PR:N/UI:N/S:U/C...