Filtered by vendor Mattermost
Subscriptions
Filtered by product Mattermost Server
Subscriptions
Total
215 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2017-18885 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 9.8 Critical |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf. | ||||
| CVE-2017-18884 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 8.1 High |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens. | ||||
| CVE-2017-18883 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 9.1 Critical |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data. | ||||
| CVE-2017-18882 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data. | ||||
| CVE-2017-18881 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command. | ||||
| CVE-2017-18880 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the title_link field of a Slack attachment. | ||||
| CVE-2017-18879 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment. | ||||
| CVE-2017-18878 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session. | ||||
| CVE-2017-18877 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page. | ||||
| CVE-2017-18876 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.9 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file. | ||||
| CVE-2017-18875 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.9 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files. | ||||
| CVE-2017-18874 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.5 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal. | ||||
| CVE-2017-18873 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 5.3 Medium |
| An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post. | ||||
| CVE-2017-18872 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 Medium |
| An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider. | ||||
| CVE-2017-18871 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 7.5 High |
| An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name. | ||||
| CVE-2017-18870 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 Medium |
| An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case. | ||||
| CVE-2016-11084 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. | ||||
| CVE-2016-11083 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. | ||||
| CVE-2016-11082 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 6.1 Medium |
| An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. | ||||
| CVE-2016-11081 | 1 Mattermost | 1 Mattermost Server | 2024-11-21 | 4.3 Medium |
| An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser. | ||||