Filtered by vendor Mattermost
Subscribe
Total
499 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2017-18871 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
|
|||||
| CVE-2017-18870 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 3.5 LOW | 4.3 MEDIUM |
|
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.
|
|||||
| CVE-2016-11084 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
|
|||||
| CVE-2016-11083 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
|
|||||
| CVE-2016-11082 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
|
|||||
| CVE-2016-11081 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.0 MEDIUM | 4.3 MEDIUM |
|
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.
|
|||||
| CVE-2016-11080 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.0 MEDIUM | 4.3 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
|
|||||
| CVE-2016-11079 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
|
|||||
| CVE-2016-11078 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
|
|||||
| CVE-2016-11077 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.0 MEDIUM | 2.7 LOW |
|
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
|
|||||
| CVE-2016-11076 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
|
|||||
| CVE-2016-11075 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
|
|||||
| CVE-2016-11074 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
|
|||||
| CVE-2016-11073 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
|
|||||
| CVE-2016-11072 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.4 MEDIUM | 6.5 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
|
|||||
| CVE-2016-11071 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
|
|||||
| CVE-2016-11070 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
|
|||||
| CVE-2016-11069 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
|
|||||
| CVE-2016-11068 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
|
|||||
| CVE-2016-11067 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
|
|||||
| CVE-2016-11066 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
|
|||||
| CVE-2016-11065 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.0 MEDIUM | 4.3 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.
|
|||||
| CVE-2016-11064 | 1 Mattermost | 1 Mattermost Desktop | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
|
An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
|
|||||
| CVE-2016-11063 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
|
|||||
| CVE-2016-11062 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.0 MEDIUM | 5.3 MEDIUM |
|
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
|
|||||
| CVE-2015-9548 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
|
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.
|
|||||
| CVE-2024-36250 | 1 Mattermost | 1 Mattermost Server | 2024-11-14 | N/A | 4.8 MEDIUM |
|
Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds
|
|||||
| CVE-2024-42000 | 1 Mattermost | 1 Mattermost Server | 2024-11-14 | N/A | 4.3 MEDIUM |
|
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels.
|
|||||
| CVE-2024-52032 | 1 Mattermost | 1 Mattermost Server | 2024-11-14 | N/A | 4.3 MEDIUM |
|
Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled.
|
|||||
| CVE-2024-46872 | 1 Mattermost | 1 Mattermost Server | 2024-11-08 | N/A | 4.6 MEDIUM |
|
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks
|
|||||
| CVE-2024-10214 | 1 Mattermost | 1 Mattermost | 2024-11-05 | N/A | 3.5 LOW |
|
Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.
|
|||||
| CVE-2024-45835 | 1 Mattermost | 1 Mattermost Desktop | 2024-11-01 | N/A | 6.5 MEDIUM |
|
Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.
|
|||||
| CVE-2024-39772 | 1 Mattermost | 1 Mattermost Desktop | 2024-11-01 | N/A | 5.3 MEDIUM |
|
Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.
|
|||||
| CVE-2024-40884 | 1 Mattermost | 1 Mattermost Server | 2024-10-17 | N/A | 2.7 LOW |
|
Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.
|
|||||
| CVE-2024-43780 | 1 Mattermost | 1 Mattermost Server | 2024-10-16 | N/A | 4.3 MEDIUM |
|
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.
|
|||||
| CVE-2024-42497 | 1 Mattermost | 1 Mattermost Server | 2024-10-16 | N/A | 4.9 MEDIUM |
|
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.
|
|||||
| CVE-2024-42406 | 1 Mattermost | 1 Mattermost Server | 2024-10-01 | N/A | 5.4 MEDIUM |
|
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files.
|
|||||
| CVE-2024-47145 | 1 Mattermost | 1 Mattermost Server | 2024-09-26 | N/A | 4.3 MEDIUM |
|
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.
|
|||||
| CVE-2024-47003 | 1 Mattermost | 1 Mattermost Server | 2024-09-26 | N/A | 6.5 MEDIUM |
|
Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.
|
|||||
| CVE-2024-45843 | 1 Mattermost | 1 Mattermost Server | 2024-09-26 | N/A | 5.4 MEDIUM |
|
Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.
|
|||||