Mattermost
Page 7 of 7 — Mattermost CVEs from a corpus of 648, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-20874 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change. |
CVE-2019-20873 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation… |
CVE-2019-20872 | Medium | 5.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services. |
CVE-2019-20871 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking. |
CVE-2019-20870 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID. |
CVE-2019-20869 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private… |
CVE-2019-20868 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated. |
CVE-2019-20867 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post. |
CVE-2019-20866 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP… |
CVE-2019-20865 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF. |
CVE-2019-20864 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitH… |
CVE-2019-20863 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted. |
CVE-2019-20862 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands. |
CVE-2019-20861 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link. |
CVE-2019-20860 | Medium | 5.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application han… |
CVE-2019-20859 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input. |
CVE-2019-20858 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL… |
CVE-2019-20857 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backtick charact… |
CVE-2019-20856 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection. |
CVE-2019-20855 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during… |
CVE-2019-20854 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX… |
CVE-2019-20853 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execution problem. |
CVE-2019-20852 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message cont… |
CVE-2019-20851 | Critical | 9.1 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary… |
CVE-2020-14460 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require… |
CVE-2020-14459 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002. |
CVE-2020-14458 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004. |
CVE-2020-14457 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020… |
CVE-2020-14456 | High | 7.3 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-202… |
CVE-2020-14455 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007. |
CVE-2020-14454 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandle… |
CVE-2020-14453 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial o… |
CVE-2020-14452 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014. |
CVE-2020-14451 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMS… |
CVE-2020-14450 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-00… |
CVE-2020-14449 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka MMSA-2020-0018. |
CVE-2020-14448 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka… |
CVE-2020-14447 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-… |
CVE-2019-20850 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout. |
CVE-2019-20849 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout. |
CVE-2019-20848 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies. |
CVE-2019-20847 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel. |
CVE-2019-20846 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage. |
CVE-2019-20845 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import. |
CVE-2019-20844 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the t… |
CVE-2019-20843 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files. |
CVE-2019-20842 | High | 7.2 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels. |
CVE-2019-20841 | High | 8.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account take… |