Filtered by vendor Mattermost
Subscriptions
Filtered by product Mattermost Server
Subscriptions
Total
227 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2022-2366 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 5.6 Medium |
Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers. | ||||
CVE-2022-2401 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 6.5 Medium |
Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs. | ||||
CVE-2022-3147 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 3.1 Low |
Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Service. | ||||
CVE-2022-3257 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 3.1 Low |
Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service. | ||||
CVE-2023-27265 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 2.7 Low |
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response. | ||||
CVE-2023-27266 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 2.7 Low |
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response. | ||||
CVE-2023-1421 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 3.5 Low |
A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter. | ||||
CVE-2023-1774 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 4.2 Medium |
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. | ||||
CVE-2023-1775 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 4.3 Medium |
When running in a High Availability configuration, Mattermost fails to sanitize some of the user_updated and post_deleted events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients. | ||||
CVE-2023-1776 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 7.3 High |
Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. | ||||
CVE-2023-1777 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 6.5 Medium |
Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message. | ||||
CVE-2023-1831 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 7.2 High |
Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config). | ||||
CVE-2023-2281 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 3.1 Low |
When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. This allows the clients to see the name, display name, description, and other data about the archived team. | ||||
CVE-2023-2515 | 1 Mattermost | 1 Mattermost Server | 2024-12-07 | 4.7 Medium |
Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin | ||||
CVE-2023-45847 | 1 Mattermost | 1 Mattermost Server | 2024-12-02 | 4.3 Medium |
Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to send a specially crafted request and crash the Playbooks plugin | ||||
CVE-2024-24776 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 3.1 Low |
Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts being leaked to a user without permissions. | ||||
CVE-2024-24774 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 3.4 Low |
Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who created the subscription resulting in registered users on Jira being able to create webhooks that give them access to all Jira issues. | ||||
CVE-2024-23319 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 3.5 Low |
Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a user's Jira connection in Mattermost only by viewing the message. | ||||
CVE-2024-1402 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 Medium |
Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom emojis allowed to be added in a post, allowing an attacker sending a huge amount of non-existent custom emojis in a post to crash the mobile app of a user seeing the post and to crash the server due to overloading when clients attempt to retrive the aforementioned post. | ||||
CVE-2023-7113 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 3.7 Low |
Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client. |