CVE-2024-28053 Resource Exhaustion via the Invitation Feature

Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server...

CVE-2024-28053

CVE-2024-28053 – Mattermost Server : A resource-exhaustion flaw in Mattermost Server 8.1.x prior to 8.1.10 allows an attacker to read/parse an email payload without limiting its size, enabling a very large payload to crash the server. Affected are Mattermost Server 8.1.x versions before 8.1.10. T...

CVE-2024-28053 Resource Exhaustion via the Invitation Feature

Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server...

CVE-2024-28053 Resource Exhaustion via the Invitation Feature

Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server...

Mattermost 安全漏洞

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A denial of service vulnerability exists in Mattermost Server, which can be exploited by an attacker to cause the server to crash...

PT-2024-22239 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions 8.1.x before 8.1.10 Description: The issue is related to resource exhaustion, where the server fails to limit the size of the payload that can be read and parsed, allowing an attacker to send a very large email...

Mattermost Server Denial of Service Vulnerability (CNVD-2024-26110)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A denial of service vulnerability exists in Mattermost Server, which can be exploited by an attacker to cause the server to crash...

Mattermost Server 5.34.x < 7.1.9 / 7.2.x < 7.8.4 / 7.9.x < 7.9.3 / 7.10.0 (MMSA-2023-00159)

The version of Mattermost Server installed on the remote host is prior to 7.1.9, 7.8.4, or 7.9.3 / 7.10.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2023-00159 advisory. - Mattermost fails to normalize UTF confusable characters when determining if a preview should be...

BIT-MATTERMOST-2020-14447

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

BIT-MATTERMOST-2020-14448

An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0020...

BIT-MATTERMOST-2020-14452

An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014...

BIT-MATTERMOST-2020-14453

An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005...

BIT-MATTERMOST-2020-14457

An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the updateteam WebSocket event, aka MMSA-2020-0012...

BIT-MATTERMOST-2022-0903

A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body...

BIT-MATTERMOST-2022-0904

A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted Apple Pages document...

Race Condition

github.com/mattermost/mattermost-server is vulnerable to a race condition. The vulnerability is due to a failure in handling concurrent requests of post creation and post deletion. An authenticated attacker can exploit this to gain an unauthorized access to individual post's contents via carefull...

Denial Of Service (DOS)

github.com/mattermost/mattermost-server is vulnerable to a Denial of Service DoS. The vulnerability is due to improper validation of the length of the emoji value in the custom user status, allowing an attacker to send a very long string as an emoji value multiple times, causing high resource...

Mattermost Server < 8.1.8 / 9.x < 9.1.5 / 9.2.x < 9.2.4 (MMSA-2023-00276)

The version of Mattermost Server installed on the remote host is prior to 8.1.8, 9.x prior to 9.1.5 or 9.2.x prior to 9.2.4. It is, therefore, affected by a vulnerability as referenced in the MMSA-2023-00276 advisory. - Mattermost fails to check if a custom emoji reaction exists when sending it t...

CVE-2023-48369 Log Flooding due to specially crafted requests in different endpoints

Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow the log...

Mattermost Server < 7.8.12 / 8.0.x < 8.0.4 / 8.1.x < 8.1.3 / 9.0.0 Multiple Vulnerabilities (MMSA-2023-00240) (MMSA-2023-00242) (MMSA-2023-00246)

The version of Mattermost Server running on the remote host is prior to 7.8.12, 8.0.x prior to 8.0.3, 8.1.x prior to 8.1.3 or 9.0.0. It is, therefore, affected by multiple vulnerabilities: - Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request...