Filtered by vendor Mattermost
Subscriptions
Filtered by product Mattermost Server
Subscriptions
Total
206 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2017-18917 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 7.5 High |
| An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens. | ||||
| CVE-2017-18908 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 9.8 Critical |
| An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address. | ||||
| CVE-2017-18897 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection. | ||||
| CVE-2017-18909 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 7.5 High |
| An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory. | ||||
| CVE-2017-18890 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 4.3 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request. | ||||
| CVE-2017-18896 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint. | ||||
| CVE-2017-18899 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting. | ||||
| CVE-2017-18904 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file. | ||||
| CVE-2017-18870 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 4.3 Medium |
| An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case. | ||||
| CVE-2017-18906 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 8.1 High |
| An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account. | ||||
| CVE-2017-18898 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang. | ||||
| CVE-2017-18881 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command. | ||||
| CVE-2017-18913 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page. | ||||
| CVE-2017-18911 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 9.1 Critical |
| An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server. | ||||
| CVE-2017-18882 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data. | ||||
| CVE-2017-18873 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post. | ||||
| CVE-2017-18878 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 4.3 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session. | ||||
| CVE-2017-18883 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 9.1 Critical |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data. | ||||
| CVE-2017-18905 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. | ||||
| CVE-2017-18916 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction. | ||||