Filtered by vendor Mattermost
Subscriptions
Filtered by product Mattermost Server
Subscriptions
Total
227 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2016-11072 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.5 Medium |
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled. | ||||
CVE-2016-11071 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place. | ||||
CVE-2016-11070 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.4 Medium |
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values. | ||||
CVE-2016-11069 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 7.5 High |
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. | ||||
CVE-2016-11068 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.3 Medium |
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. | ||||
CVE-2016-11067 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.3 Medium |
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang. | ||||
CVE-2016-11066 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 7.5 High |
An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information. | ||||
CVE-2016-11065 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 Medium |
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance. | ||||
CVE-2016-11063 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview. | ||||
CVE-2016-11062 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.3 Medium |
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed. | ||||
CVE-2015-9548 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 7.5 High |
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed. | ||||
CVE-2024-36250 | 1 Mattermost | 1 Mattermost Server | 2024-11-14 | 3.1 Low |
Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds | ||||
CVE-2024-42000 | 1 Mattermost | 1 Mattermost Server | 2024-11-14 | 2.7 Low |
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels. | ||||
CVE-2024-52032 | 1 Mattermost | 1 Mattermost Server | 2024-11-14 | 4.3 Medium |
Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled. | ||||
CVE-2024-46872 | 1 Mattermost | 1 Mattermost Server | 2024-11-08 | 4.6 Medium |
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks | ||||
CVE-2024-40884 | 1 Mattermost | 1 Mattermost Server | 2024-10-17 | 2.7 Low |
Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL. | ||||
CVE-2024-43780 | 1 Mattermost | 1 Mattermost Server | 2024-10-16 | 4.3 Medium |
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel. | ||||
CVE-2024-42497 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2024-10-16 | 6 Medium |
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams. | ||||
CVE-2024-42406 | 1 Mattermost | 1 Mattermost Server | 2024-10-01 | 5.4 Medium |
Mattermost versions 9.11.x <= 9.11.0, 9.10.x <= 9.10.1, 9.9.x <= 9.9.2 and 9.5.x <= 9.5.8 fail to properly authorize requests when viewing archived channels is disabled, which allows an attacker to retrieve post and file information about archived channels. Examples are flagged or unread posts as well as files. | ||||
CVE-2024-47145 | 1 Mattermost | 1 Mattermost Server | 2024-09-26 | 3.1 Low |
Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links. |