CVE-2024-36255 Post actions can run playbook checklist task commands

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper input validation on post actions which allows an attacker to run a playbook checklist task command as another user via creating and sharing a deceptive post action that unexpectedly runs a slash command in...

PT-2024-26935 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.12 Mattermost versions 9.5.x through 9.5.3 Mattermost versions 9.6.x through 9.6.1 Description: The issue arises from inadequate input validation on post actions, allowing an attacker to execute a playboo...

CVE-2023-28357

A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...

Design/Logic Flaw

A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...

Rocket.Chat 信息泄露漏洞

Rocket.Chat is an open source team chat software. An information disclosure vulnerability exists in versions prior to Rocket.Chat 6.0, which stems from an ACL check in the slash command /mute, after checking if a user is a member of a given channel, which can disclose private channel members to...

PT-2023-21667 · Rocket.Chat · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat affected versions not specified Description: A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command "/mute" occur after checking whether a user is a member of a given channel, leaking private...

CVE-2023-28357

A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...

CVE-2023-28357

CVE-2023-28357 affects Rocket.Chat. The vulnerability arises in the Slash Command /mute, where an ACL check occurs after confirming a user’s channel membership, allowing authenticated users to enumerate whether a username is a member of a channel they cannot access. Impact described as informatio...

CVE-2023-28357

A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...

Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command

An issue was discovered in Mattermost Server before 5.1.0. It allows attackers to cause a denial of service via the invitepeople slash command...

GHSA-5MH6-P63G-3MV5 Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command

An issue was discovered in Mattermost Server before 5.1.0. It allows attackers to cause a denial of service via the invitepeople slash command...

GHSA-JP57-4X34-5V94 Mattermost Server is vulnerable to webhook and slash command manipulation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...

Rocket.Chat: Mute User can disclose private channel members to unauthorized users

Vulnerability description not provided...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-41168)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.1. The vulnerability can be exploited by an attacker to bypass access control with the Message slash / command...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-41496)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server. An attacker could exploit this vulnerability to cause a denial of service memory consumption via an outgoing Webhook or slash command integratio...

Unspecified Vulnerability in Mattermost Server (CNVD-2020-48225)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 5.1. An attacker can exploit this vulnerability to bypass the intended access restrictions for creating group message channels...

Command injection

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a gotolocation response to a slash command...

CVE-2019-20888

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...

CVE-2018-21254

An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...

Command injection

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...