CVE-2025-41395 Webapp DoS via malicious retrospective post in Playbooks

Mattermost versions 10.4.x = 10.4.2, 10.5.x = 10.5.0, 9.11.x = 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of servi...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an input validation error vulnerability that stems from insufficient props validation, which can be exploited by an attacker to cause a denial of service attack...

CVE-2025-20072 Mobile crash via improper validation of proto style in attachments

Mattermost Mobile versions = 2.22.0 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the mobile via crafted malicious input...

CVE-2025-20088 Insufficient Input Validation on Post Props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-20086 Insufficient Input Validation on Post Props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-20088 Insufficient Input Validation on Post Props

Mattermost versions 10.2.x = 10.2.0, 9.11.x = 9.11.5, 10.0.x = 10.0.3, 10.1.x = 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-21083 Insufficient Input Validation on Post Props

Mattermost Mobile Apps versions =2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-20036 Insufficient Input Validation on Post Props

Mattermost Mobile Apps versions =2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-20036 Insufficient Input Validation on Post Props

Mattermost Mobile Apps versions =2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

CVE-2025-20036 Insufficient Input Validation on Post Props

Mattermost Mobile Apps versions =2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post...

PT-2025-5656 · Avif · Avif

Name of the Vulnerable Software and Affected Versions: avif affected versions not specified Description: A heap buffer overflow read issue has been identified. The crash occurs in the avifImageAddUUIDProperty function, as indicated by the crash state. Technical details about the issue include the...

CVE-2024-54083 DoS via lack of type validation in Calls

Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side webapp and mobile DoS to users of particular channels, by sending a specially crafted post...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization of the props passed to the components tab. An attacker could steal sensitive data or execute requests impersonating a user by exploiting this vulnerability. PoC js Hello test import...

CVE-2024-32939 Email addresses of remote users visible in props regardless of server settings

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."...

CVE-2024-32939 Email addresses of remote users visible in props regardless of server settings

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."...

MAL-2024-7958 Malicious code in frontend-static-props-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb3f52abf232df0db4fc9cbe55d6234cff445cff215bbeb3e5a26a4f26b843a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2024-24265

gpac v2.2.1 was discovered to contain a memory leak via the dstprops variable in the gffilterpidmergepropertiesinternal function...

PT-2023-35621 · Git +1 · Wolfmqtt

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state involves several functions: MqttProps Free, Handle Props, and MqttClient...

GHSA-33R7-WJFC-7W98 Mattermost Uncontrolled Resource Consumption vulnerability

Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notificationprop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users...

Mattermost Uncontrolled Resource Consumption vulnerability

Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notificationprop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users...