PT-2020-8427

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server where XSS could occur via a goto location response to a slash command...

CVE-2018-21257: Missing Authorization

An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions for setting a channel header via the Channel header slash command API...

CVE-2018-21258: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invitepeople slash command...

PT-2020-8896

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Mattermost Server version 5.0.2 and earlier Mattermost Server version 4.10.2 and earlier Description An issue was discovered in Mattermost Server. An attacker could use the invite people slash command to...

PT-2020-8435

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server. An attacker could create fictive system-message posts via webhooks and slash...

PT-2020-10825

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.13.0 Description An issue was discovered that allows non-members to fetch a team's slash commands. Recommendations For versions prior to 5.13.0, update to version 5.13.0 or later to resolve the issue...

CVE-2017-18881: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a gotolocation response to a slash command...

CVE-2018-21256: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions for group-message channel creation via the Group message slash command...

CVE-2019-20888: Missing Release of Memory after Effective Lifetime

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...

CVE-2017-18886: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...

PT-2020-8432

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.3.0 Mattermost Server version 4.2.1 Mattermost Server version 4.1.2 Description: An issue was discovered in Mattermost Server that allows a bypass of restrictions on use of slash commands. Recommendations...

CVE-2019-20862: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands...

PT-2020-10852

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.7 Mattermost Server version 5.6.3 and earlier Mattermost Server version 5.5.2 and earlier Mattermost Server version 4.10.5 and earlier Description An issue in Mattermost Server allows attackers to cause a...

PT-2020-8900

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue was discovered that allows attackers to bypass intended access restrictions for setting a channel header via the Channel header slash command API. Recommendations For versions prior ...

PT-2020-8897

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.1 Description An issue was discovered that allows an attacker to bypass intended access control for direct-message channel creation via the Message slash command. Recommendations For versions prior to 5.1,...

kernel: denial of service via ioctl call in network tun handling

A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service NULL pointer dereference and panic via an ioctl TUNSETIFF call with a dev name containing a / character...

ONKYO Onkyo TX-NR585 Information Disclosure Vulnerability

The ONKYO Onkyo TX-NR585 is a home audio/video receiver from ONKYO Japan. A security vulnerability exists in the ONKYO Onkyo TX-NR585 using firmware version 1000-0000-000-0008-0000. The vulnerability can be exploited by a remote attacker to read sensitive files with the help of the...

The vulnerability of the Eclipse Mosquitto messaging broker, related to insufficient checking of exclusive states, allows a hacker to trigger a service failure.

The vulnerability of the Eclipse Mosquitto messaging broker is related to insufficient checking of exceptional states. Exploiting this vulnerability allows a malicious actor to cause a service failure by sending a SUBSCRIBE packet containing approximately 65,400 or more characters '/'...

kernel: denial of service via ioctl call in network tun handling

A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service NULL pointer dereference and panic via an ioctl TUNSETIFF call with a dev name containing a / character...

kernel: denial of service via ioctl call in network tun handling

A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service NULL pointer dereference and panic via an ioctl TUNSETIFF call with a dev name containing a / character...