1633 matches found
Mattermost Server 10.5.x < 10.5.11 / 10.10.x < 10.10.3 / 10.11.x 10.11.3 / 10.12.0 Missing Authorization (MMSA-2025-00525)
The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2025-00525 advisory. - Mattermost versions 10.10.x = 10.10.2, 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to validate email ownership during Slack import process which allows...
Mattermost Server 10.5.x < 10.5.11 / 10.11.x < 10.11.3 / 10.12.0 Multiple Vulnerabilities (MMSA-2025-00497, MMSA-2025-00496, MMSA-2025-00516)
The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2025-00497, MMSA-2025-00496, MMSA-2025-00516 advisories. - Mattermost versions 10.5.x = 10.5.10, 10.11.x = 10.11.2 fail to properly validate guest user permissions when...
Missing Authorization
Overview github.com/mattermost/mattermost-server is an open source Slack-alternative in Golang and React. Affected versions of this package are vulnerable to Missing Authorization via the Slack import functionality. An attacker can create verified user accounts with arbitrary email domains by...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the /api/v4/channels/channelid/members endpoint. An attacker can gain unauthorized access to add any team members to private channels by exploiting insufficient validation of guest user permissions. Remediati...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the RelayState parameter. An attacker can gain unauthorized access to any team by manipulating the RelayState parameter during the team join process. Remediation Upgrade github.com/mattermost/mattermost/server t...
Missing Authorization
Overview github.com/mattermost/mattermost-server is an open source Slack-alternative in Golang and React. Affected versions of this package are vulnerable to Missing Authorization in the RelayState parameter. An attacker can gain unauthorized access to any team by manipulating the RelayState...
Timing Attack
Overview Affected versions of this package are vulnerable to Timing Attack via the IsValidWebAuthRedirectURL function. An attacker can obtain sensitive information such as Cloud API keys and OAuth client secrets by analyzing response times during authentication attempts. Remediation Upgrade...
Timing Attack
Overview Affected versions of this package are vulnerable to Timing Attack via the IsValidWebAuthRedirectURL function. An attacker can obtain sensitive information such as Cloud API keys and OAuth client secrets by analyzing response times during authentication attempts. Remediation Upgrade...
Timing Attack
Overview github.com/mattermost/mattermost-server is an open source Slack-alternative in Golang and React. Affected versions of this package are vulnerable to Timing Attack via the IsValidWebAuthRedirectURL function. An attacker can obtain sensitive information such as Cloud API keys and OAuth...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the RelayState parameter. An attacker can gain unauthorized access to any team by manipulating the RelayState parameter during the team join process. Remediation Upgrade...
Missing Authorization
Overview github.com/mattermost/mattermost-server is an open source Slack-alternative in Golang and React. Affected versions of this package are vulnerable to Missing Authorization via the /api/v4/teams/teamid/channels/ids endpoint. An attacker can access sensitive channel metadata by sending...
Missing Authorization
Overview github.com/mattermost/mattermost-server is an open source Slack-alternative in Golang and React. Affected versions of this package are vulnerable to Missing Authorization in the fullyQualifiedRedirectURL function. An attacker can gain unauthorized access to any team by manipulating the...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the /api/v4/teams/teamid/channels/ids endpoint. An attacker can access sensitive channel metadata by sending requests as a guest user. Remediation Upgrade...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the fullyQualifiedRedirectURL function. An attacker can gain unauthorized access to any team by manipulating the invite token, bypassing intended restrictions. Remediation Upgrade...
EUVD-2018-13776
Malware in sbrugna...
EUVD-2016-2071
Malware in sbrugna...
EUVD-2019-11421
Malware in sbrugna...
EUVD-2017-9962
Malware in sbrugna...