CVE-2019-20863

An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted...

CVE-2019-20863

An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted...

CVE-2019-20863

CVE-2019-20863 affects Mattermost Server prior to 5.13.0, where incoming webhook creation is not properly restricted. This is a usability/authorization flaw in webhook provisioning that could enable misconfiguration or abuse by an attacker with access to create webhooks. The available documents c...

CVE-2019-20863

An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted...

CVE-2020-14447

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

Denial of service

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

CVE-2020-14447

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

CVE-2020-14447

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

PT-2020-14007 · Mattermost · Mattermost Server

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 5.23.0 Description: An issue allows attackers to cause a denial of service infinite loop by sending large webhook requests. Recommendations: For versions prior to 5.23.0, update to version 5.23.0 or later t...

PT-2020-10826

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.13.0 Description An issue was discovered where incoming webhook creation is not properly restricted. Recommendations For versions prior to 5.13.0, update to version 5.13.0 or later to resolve the issue...

PT-2020-10852

Name of the Vulnerable Software and Affected Versions Mattermost Server versions prior to 5.7 Mattermost Server version 5.6.3 and earlier Mattermost Server version 5.5.2 and earlier Mattermost Server version 4.10.5 and earlier Description An issue in Mattermost Server allows attackers to cause a...

CVE-2017-18870: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case...

CVE-2019-20888: Missing Release of Memory after Effective Lifetime

An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service memory consumption via an outgoing webhook or a slash command integration...

CVE-2019-20863: Undefined Security Weakness

An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted...

CVE-2020-14447: Loop with Unreachable Exit Condition

An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0021...

PT-2020-8416

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.5.0 Mattermost Server version 4.4.5 Mattermost Server version 4.3.4 Description: The issue concerns the mishandling of webhook access control in the EnableOnlyAdminIntegrations case. Recommendations: For...

Citrix XenMobile Server 10.8 XML Injection

Exploit Title: Citrix XenMobile Server 10.8 - XML External Entity Injection Google Dork: inurl:zdm logon Date: 2019-11-28 Exploit Author: Jonas Lejon Vendor Homepage: https://www.citrix.com Software Link: Version: XenMobile Server 10.8 before RP2 and 10.7 before RP3 Tested on: XenMobile CVE :...

Citrix XenMobile Server 10.8 - XML External Entity Injection

Citrix XenMobile Server 10.8 - XML External Entity Injection Exploit Title: Citrix XenMobile Server 10.8 - XML External Entity Injection Google Dork: inurl:zdm logon Date: 2019-11-28 Exploit Author: Jonas Lejon Vendor Homepage: https://www.citrix.com Software Link: Version: XenMobile Server 10.8...

CVE-2019-10459

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...