Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially o…
Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessiv…
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML…
Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/r…
Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a …
Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial…
Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including pa…
Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to t…
Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sendin…
Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file infor…
Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_p…
Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not p…
Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thu…
Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged
Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to …
Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin'…
Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept t…
Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.
Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.
Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs.
Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.
Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared …
Mattermost fails to sanitize ephemeral error messages, allowing an attacker to obtain arbitrary message contents by a specially crafted /groupmsg com…
Mattermost fails to validate links on external websites when constructing a preview for a linked website, allowing an attacker to cause a denial-of-s…
Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink…
Mattermost fails to unescape Markdown strings in a memory-efficient way, allowing an attacker to cause a Denial of Service by sending a message conta…
Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install…
Mattermost fails to check channel membership when accessing message threads, allowing an attacker to access arbitrary posts by using the message thre…
Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persi…
Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to tr…