An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
9.8CVSS
9.6AI Score
0.002EPSS
An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and notifications).
5.3CVSS
5.3AI Score
0.001EPSS
An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.
9.8CVSS
9.6AI Score
0.002EPSS
An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.
8.8CVSS
8.8AI Score
0.003EPSS
An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008.
6.1CVSS
6.2AI Score
0.001EPSS
An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007.
6.5CVSS
6.5AI Score
0.002EPSS
An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006.
7.3CVSS
7.2AI Score
0.001EPSS
Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website
5.4CVSS
5.5AI Score
0.0005EPSS
Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged.
5.5CVSS
5.5AI Score
0.0004EPSS
Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious mattermost server
5.3CVSS
5.2AI Score
0.0005EPSS
Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service.
5.3CVSS
5.2AI Score
0.0004EPSS
Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard input.
3.3CVSS
4.1AI Score
0.0004EPSS
Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.
3.8CVSS
4.3AI Score
0.0004EPSS
Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.
6.1CVSS
4.9AI Score
0.0005EPSS
Mattermost Desktop App versions <=5.8.0 fail to specify an absolute path when searching the cmd.exe file, which allows a local attacker who is able to put an cmd.exe file in the Downloads folder of a user's machine to cause remote code execution on that machine.
7.8CVSS
5.9AI Score
0.001EPSS