5182 matches found
Code injection
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection...
CVE-2017-18872
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...
CVE-2017-18872
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...
Design/Logic Flaw
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...
CVE-2017-18894
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover...
CVE-2017-18894
Mattermost Server before 4.2.0, 4.1.1, and 4.0.5 is affected when used as an OAuth 2.0 service provider: resource-owner authorization can be intermittently bypassed, enabling account takeover. Root cause: bypass of resource-owner authorization in OAuth 2.0 flow. Impact: potential account takeover...
CVE-2017-18897
CVE-2017-18897 affects Mattermost Server pre-4.2.0, 4.1.1 and 4.0.5 when used as an OAuth 2.0 service provider. The issue is that the implementation mishandles a deny action for a redirection, constituting a logic/process flow problem in the OAuth redirect handling. Publicly provided connected so...
CVE-2017-18897
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection...
CVE-2017-18884
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens...
CVE-2017-18883
The CVE-2017-18883 entry concerns Mattermost Server versions prior to 4.3.0, 4.2.1, and 4.1.2 when acting as an OAuth 2.0 Service Provider. The underlying issue is low entropy for authorization data, as described in Red Hat, SUSE, and other connected sources. The affected component is the OAuth 2...
CVE-2017-18883
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...
CVE-2017-18872
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...
CVE-2017-18872
Mattermost Server, prior to version 4.4.3 and 4.3.3, is affected. In these releases, when Mattermost operates as an OAuth 2.0 service provider, an issue could allow attackers to reconfigure an OAuth app in some scenarios. The vulnerability centers on the OAuth app configuration within mattermost-...
CVE-2017-18877
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...
CVE-2017-18877
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...
CVE-2017-18877
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page...
CVE-2017-18877
Mattermost Server contains an XSS vulnerability in the OAuth 2.0 allow/deny page for affected releases (Mattermost Server before 4.3.0, 4.2.1, and 4.1.2). Root cause details are not provided in the documents beyond the page-level description. Exploitation status is not specified; no in-the-wild e...