Filtered by vendor Mattermost
Subscriptions
Filtered by product Mattermost Server
Subscriptions
Total
206 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-20845 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 7.5 High |
| An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import. | ||||
| CVE-2019-20843 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 7.5 High |
| An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files. | ||||
| CVE-2019-20841 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 8.8 High |
| An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks. | ||||
| CVE-2019-20847 | 1 Mattermost | 1 Mattermost Server | 2024-08-05 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel. | ||||
| CVE-2020-14459 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 7.5 High |
| An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002. | ||||
| CVE-2020-14453 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 7.5 High |
| An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005. | ||||
| CVE-2020-14450 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 7.5 High |
| An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-0017. | ||||
| CVE-2020-14458 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 7.5 High |
| An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004. | ||||
| CVE-2020-14452 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014. | ||||
| CVE-2020-14457 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012. | ||||
| CVE-2020-14460 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 6.5 Medium |
| An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001. | ||||
| CVE-2020-14448 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 7.5 High |
| An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0020. | ||||
| CVE-2020-14447 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 7.5 High |
| An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0021. | ||||
| CVE-2021-37862 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 3.7 Low |
| Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token. | ||||
| CVE-2021-37863 | 1 Mattermost | 1 Mattermost Server | 2024-08-04 | 3.5 Low |
| Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post. | ||||
| CVE-2022-3257 | 1 Mattermost | 1 Mattermost Server | 2024-08-03 | 3.1 Low |
| Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service. | ||||
| CVE-2022-3147 | 1 Mattermost | 1 Mattermost Server | 2024-08-03 | 3.1 Low |
| Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows authenticated users to cause resource exhaustion on specific system configurations, resulting in server-side Denial of Service. | ||||
| CVE-2022-2401 | 1 Mattermost | 1 Mattermost Server | 2024-08-03 | 6.5 Medium |
| Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs. | ||||
| CVE-2022-2366 | 1 Mattermost | 1 Mattermost Server | 2024-08-03 | 5.6 Medium |
| Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers. | ||||
| CVE-2022-1982 | 1 Mattermost | 1 Mattermost Server | 2024-08-03 | 4.3 Medium |
| Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post. | ||||