2131 matches found
CVE-2018-21251
An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body...
CVE-2018-21249
An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing...
CVE-2018-21249
Mattermost Server prior to version 5.3.0 is affected by a timing mishandling issue. Affected product: Mattermost Server (versions before 5.3.0). Root cause: timing mishandling in the server. Reported impact is limited in the provided materials, with CVSS indicating low to medium severity (base sc...
CVE-2018-21249
An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing...
CVE-2017-18875
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files...
CVE-2017-18875
Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 is vulnerable when local storage for files is used. A System Admin can create arbitrary files due to the underlying issue. Connected sources (SUSE SU-2025 and related advisories) confirm the affected versions and the same impact, but the provided d...
CVE-2017-18870
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case...
CVE-2017-18870
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case...
CVE-2018-21259
An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service application hang via a malformed link in a channel...
CVE-2019-20889
Mattermost Server is vulnerable to a permissions handling flaw in user-access token creation in versions prior to 5.7, 5.6.3, 5.5.2, and 4.10.5. Root cause: improper handling of permissions when creating user-access tokens. The provided documents do not include exploitation details or remediation...
CVE-2019-20889
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation...
CVE-2019-20889
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation...
CVE-2018-21248
An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...
CVE-2018-21248
Mattermost Server prior to 5.4.0 is affected by an issue that mishandles possession of superfluous authentication credentials. The CVSS-3.1 base score is 7.5 (HIGH) with NETWORK attack vector, no privileges required, and HIGH impact on confidentiality (I: HIGH, C: HIGH) per the advisory. Root cau...
CVE-2018-21248
An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials...
CVE-2019-20888
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...
CVE-2019-20888
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...
CVE-2019-20886
An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin...
CVE-2019-20886
CVE-2019-20886 affects Mattermost Server before 5.8.0, where the first user created can inadvertently become a system admin. The connected documents confirm the version range and behavior but do not provide explicit exploit details or a remediation path.