7512 matches found
CVE-2019-20866
An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled...
CVE-2019-20866
CVE-2019-20866 affects Mattermost Server prior to 5.12.0. The root cause is the mishandling of IP address information by using a Proxy HTTP header instead of the source address in the IP header. Impact per sources: partial confidentiality exposure of IPs. Exploitation details are not provided in ...
CVE-2019-20865
An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF...
CVE-2019-20865
Mattermost Server is affected by CVE-2019-20865 (login page CSRF) for versions before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The connected Red Hat and CVE sources confirm the CSRF issue on the login page across these releases. The documents do not provide further technical details, exploitat...
CVE-2019-20864
Mattermost Plugins (prior to 5.13.0) are affected by CVE-2019-20864. The GitHub plugin allows an attacker to attach their Mattermost account to another user’s GitHub account, enabling account association manipulation. Documented impact and scope: authenticated or unauthenticated exploitation is n...
CVE-2019-20864
An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitHub account...
CVE-2019-20863
An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted...
CVE-2019-20863
CVE-2019-20863 affects Mattermost Server prior to 5.13.0, where incoming webhook creation is not properly restricted. This is a usability/authorization flaw in webhook provisioning that could enable misconfiguration or abuse by an attacker with access to create webhooks. The available documents c...
CVE-2019-20862
Mattermost Server before 5.13.0 is affected by CVE-2019-20862: non-members may fetch a team's slash commands. The connected sources confirm the affected product and impact description but do not provide root-cause details or a formal remediation/patch version. No exploitation specifics are includ...
CVE-2019-20862
An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands...
CVE-2019-20861
An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link...
CVE-2019-20861
The vulnerability CVE-2019-20861 affects Mattermost Desktop App prior to 4.2.2. A crafted link can allow an attacker to execute arbitrary code. The provided documents confirm the affected product/version and the high-level impact but do not include details on root cause, specific vulnerable compo...
CVE-2020-14460
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...
CVE-2020-14460
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001...
CVE-2020-14448
An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0020...
CVE-2020-14454
An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008...
CVE-2020-14457
An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the updateteam WebSocket event, aka MMSA-2020-0012...
CVE-2020-14450
An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service client-side, aka MMSA-2020-0017...