CVE-2023-5876

Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...

CVE-2023-26466

A user with non-Admin access can change a configuration file on the client to modify the Server URL...

CVE-2022-39280

dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version...

CVE-2025-2776

SysAid On-Prem versions = 23.3.40 are vulnerable to an unauthenticated XML External Entity XXE vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives...

CVE-2024-22030 Rancher agents can be hijacked by taking over the Rancher Server URL

A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle MITM attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The...

GHSA-H4H5-9833-V2P4 Rancher agents can be hijacked by taking over the Rancher Server URL

Impact A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle MITM attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability...

CVE-2024-39767 Spoofed push notifications from malicious server

Mattermost Mobile Apps versions =2.16.0 fail to validate that the push notifications received for a server actually came from this serve that which allows a malicious server to send push notifications with another server’s diagnostic ID or server URL and have them show up in mobile apps as that...

CrushFTP Directory Traversal

Exploit Title: CrushFTP Directory Traversal Google Dork: N/A Date: 2024-04-30 Exploit Author: Abdualhadi khalifa https://twitter.com/absholily Vendor Homepage: https://www.crushftp.com/ Software Link: https://www.crushftp.com/download/ Version: below 10.7.1 and 11.1.0 as well as legacy 9.x Tested...

CrushFTP < 11.1.0 - Directory Traversal

Exploit Title: CrushFTP Directory Traversal Google Dork: N/A Date: 2024-04-30 Exploit Author: Abdualhadi khalifa https://twitter.com/absholily Vendor Homepage: https://www.crushftp.com/ Software Link: https://www.crushftp.com/download/ Version: below 10.7.1 and 11.1.0 as well as legacy 9.x Tested...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-42013 Vulnerability Scanner This Python script check...

Design/Logic Flaw

Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...

CVE-2023-5876

Mattermost security issue CVE-2023-5876: a RegExp built from the server URL path is not properly validated, allowing a malicious server-enrolled attacker to cause a Denial of Service. Descriptions across sources attribute this to Mattermost and note vulnerability affects Mattermost versions up to...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from US-based Mattermost. A security vulnerability exists in Mattermost version 5.5.0 and prior versions, which stems from an inability to properly validate a regular expression constructed based on the path to a server URL, resulting in a denia...

Workspace error "Unable to add account with the given server URL"

After adding Gateway URL on Windows Workspace, we can see below error: -------- Unable to add account with the given server URL. Ensure that it is correct or enter your email address --------...

CVE-2023-26466

A user with non-Admin access can change a configuration file on the client to modify the Server URL...

Default configuration

A user with non-Admin access can change a configuration file on the client to modify the Server URL...

CVE-2023-26466

CVE-2023-26466 concerns Pegasystem PEGA Platform. A user with non-admin privileges can modify a client configuration file to change the Server URL, enabling potential manipulation of where the client talks to. The CVSS-derived impact is rated high across confidentiality, integrity, and availabili...

CVE-2023-26466

A user with non-Admin access can change a configuration file on the client to modify the Server URL...

CVE-2023-26466

A user with non-Admin access can change a configuration file on the client to modify the Server URL...

CVE-2023-0093

Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit this issue, an attacker would need t...