Sql injection

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...

CVE-2017-18886

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...

CVE-2017-18886

Mattermost Server prior to 4.3.0 (also affected: 4.2.1 and 4.1.2) contains a vulnerability that bypasses restrictions on the use of slash commands. Players can exploit this by performing slash-command actions that should be restricted. The issue is documented across multiple sources (Red Hat, SUS...

CVE-2019-20888

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...

CVE-2018-21254

An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...

Command injection

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...

CVE-2018-21254

An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...

CVE-2019-20888

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...

CVE-2018-21258

An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invitepeople slash command...

CVE-2019-20862

An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands...

CVE-2019-20862

An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands...

CVE-2019-20862

Mattermost Server before 5.13.0 is affected by CVE-2019-20862: non-members may fetch a team's slash commands. The connected sources confirm the affected product and impact description but do not provide root-cause details or a formal remediation/patch version. No exploitation specifics are includ...

CVE-2019-20862

An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands...

kernel: denial of service via ioctl call in network tun handling

A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service NULL pointer dereference and panic via an ioctl TUNSETIFF call with a dev name containing a / character...

ONKYO Onkyo TX-NR585 Information Disclosure Vulnerability

The ONKYO Onkyo TX-NR585 is a home audio/video receiver from ONKYO Japan. A security vulnerability exists in the ONKYO Onkyo TX-NR585 using firmware version 1000-0000-000-0008-0000. The vulnerability can be exploited by a remote attacker to read sensitive files with the help of the...

The vulnerability of the Eclipse Mosquitto messaging broker, related to insufficient checking of exclusive states, allows a hacker to trigger a service failure.

The vulnerability of the Eclipse Mosquitto messaging broker is related to insufficient checking of exceptional states. Exploiting this vulnerability allows a malicious actor to cause a service failure by sending a SUBSCRIBE packet containing approximately 65,400 or more characters '/'...

kernel: denial of service via ioctl call in network tun handling

A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service NULL pointer dereference and panic via an ioctl TUNSETIFF call with a dev name containing a / character...

kernel: denial of service via ioctl call in network tun handling

A flaw was found in the Linux kernel's implementation of networking tunnel device ioctl. A local attacker can cause a denial of service NULL pointer dereference and panic via an ioctl TUNSETIFF call with a dev name containing a / character...

undertow: Information leak in requests for directories without trailing slashes

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api...