CVE-2016-11069: Weak Password Requirements

An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change...

CVE-2016-11073: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting...

CVE-2016-11072: Improper Authentication

An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled...

CVE-2016-11084: Cross-Site Request Forgery (CSRF)

An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF...

CVE-2016-11083: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window...

CVE-2016-11080: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details...

CVE-2016-11075: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API...

CVE-2016-11076: Improper Certificate Validation

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

PT-2020-8427

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server where XSS could occur via a goto location response to a slash command...

PT-2020-8436

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server that allows an attacker to create a button that, when pressed by a user,...

PT-2020-8895

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.2 Mattermost Server version 5.1.1 Mattermost Server version 5.0.3 Mattermost Server version 4.10.3 Description An issue was discovered that allows attackers to bypass a domain-based policy for signups by...

PT-2020-8440

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.2.0 Mattermost Server version 4.1.1 Mattermost Server version 4.0.5 Description: An issue was discovered in Mattermost Server when used as an OAuth 2.0 service provider, where sometimes resource-owner...

CVE-2017-18891: URL Redirection to Untrusted Site

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link...

CVE-2017-18896: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint...

CVE-2017-18916: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction...

CVE-2017-18899: Allocation of Resources Without Limits or Throttling

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting...

CVE-2017-18877: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...

CVE-2017-18913: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page...

CVE-2017-18908: Improper Authentication

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address...

CVE-2018-21257: Missing Authorization

An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions for setting a channel header via the Channel header slash command API...