Browse CVEs

MEDIUM 6.1 CVE-2017-18877 An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page. Mattermost Server 4.1.2 / 4.2.1+ Fix from $1,6002020-06-19 MEDIUM 5.3 CVE-2018-21257 An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) vi… Mattermost Server 5.1.0+ Fix from $1,6002020-06-19 MEDIUM 5.3 CVE-2018-21259 An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via… Mattermost Server 4.8.2 / 4.9.4+ Fix from $1,6002020-06-19 HIGH 7.5 CVE-2017-18871 An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application cra… Mattermost Server 4.2.2 / 4.3.4+ Fix from $1,9502020-06-19 HIGH 8.8 CVE-2019-20865 An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF. Mattermost Server 4.10.10 / 5.9.2+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20868 An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated. Mattermost Server 4.10.8 / 5.7.3+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20871 An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking. Mattermost Server 4.10.8 / 5.7.3+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20874 An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a rol… Mattermost Server 4.10.8 / 5.7.3+ Fix from $1,9502020-06-19 MEDIUM 6.5 CVE-2019-20873 An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user … Mattermost Server 4.10.8 / 5.7.3+ Fix from $1,6002020-06-19 MEDIUM 5.5 CVE-2019-20872 An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services. Mattermost Server 4.10.8 / 5.7.3+ Fix from $1,6002020-06-19 MEDIUM 5.3 CVE-2019-20866 An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for ob… Mattermost Server 5.12.0+ Fix from $1,6002020-06-19 MEDIUM 5.3 CVE-2019-20867 An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post. Mattermost Server 5.11.0+ Fix from $1,6002020-06-19 MEDIUM 5.3 CVE-2019-20869 An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for… Mattermost Server 4.10.9 / 5.7.3+ Fix from $1,6002020-06-19 CRITICAL 9.8 CVE-2019-20853 An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execution pro… Mattermost Packages 5.16.3+ Fix from $2,3002020-06-19 CRITICAL 9.8 CVE-2019-20856 An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection. Mattermost Desktop 4.3.0+ Fix from $2,3002020-06-19 CRITICAL 9.1 CVE-2019-20851 An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite … Mattermost 1.26.0+ Fix from $2,3002020-06-19 HIGH 8.8 CVE-2019-20861 An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link. Mattermost Desktop 4.2.2+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20852 An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or me… Mattermost Mobile 1.26.0+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20854 An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) v… Mattermost Server 5.17.0+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20855 An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local fil… Mattermost Server 5.9.6 / 5.14.5+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20857 An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backti… Mattermost Server 5.16.0+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20858 An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters… Mattermost Server 5.15.0+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20859 An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input. Mattermost Server 4.10.8 / 5.7.3+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20862 An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands. Mattermost Server 5.13.0+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20863 An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted. Mattermost Server 5.13.0+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2019-20864 An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different per… Mattermost Plugins 5.13.0+ Fix from $1,9502020-06-19 MEDIUM 5.5 CVE-2019-20860 An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (appli… Mattermost Server 5.9.4 / 5.12.6+ Fix from $1,6002020-06-19 MEDIUM 6.5 CVE-2020-14460 An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not alway… Mattermost Server 5.9.8 / 5.16.5+ Fix from $1,6002020-06-19 HIGH 7.5 CVE-2020-14447 An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka … Mattermost Server 5.23.0+ Fix from $1,9502020-06-19 HIGH 7.5 CVE-2020-14448 An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite l… Mattermost Server 5.23.0+ Fix from $1,9502020-06-19