CVEs published in June 2020
2,026 vulnerabilities, 225 critical, 10 exploited.
- mattermost serverMattermost Server exposes information stored by a web browser4.3 Medium
- mattermost serverMattermost Server exposes account details to any Team Administrator4.3 Medium
- mattermost serverMattermost Server allows XSS via redirect URL6.1 Medium
- mattermost serverMattermost Server exposes sensitive information via its System Console UI6.5 Medium
- mattermost serverMattermost Server allows System Admin to modify LDAP account names and email addresses2.7 Low
- mattermost serverMattermost Server does not check if cookies are used over SSL5.3 Medium
- mattermost serverMattermost Server exposes sensitive information about team URLs via an API5.3 Medium
- mattermost serverMattermost Server: Insufficient Password-Reset Link Invalidation9.8 Critical
- mattermost serverMattermost Server is vulnerable to XSS via a Legal or Support setting6.1 Medium
- mattermost serverMattermost Server's Session ID and Session Token are potentially compromised6.5 Medium
- mattermost serverMattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`6.1 Medium
- mattermost serverMattermost Server is vulnerable to XSS through customizable theme color-code values5.4 Medium
- mattermost serverMattermost Server does not enforce rate limits on password change attempts7.5 High
- mattermost serverMattermost Server is vulnerable to Code Injection through its LDAP fields5.3 Medium
- mattermost serverMattermost Server is vulnerable to Uncontrolled Resource Consumption5.3 Medium
- mattermost serverMattermost Server: initial_load API exposes unnecessary information7.5 High
- linuxfoundation jaeger, the jager project jaegertracing/jaeger +1 moreInformation Exposure in jaeger7.1 High
- mattermost serverAn issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket...4.3 Medium
- mattermost desktopAn issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code...9.8 Critical
- mattermost serverMattermost Server vulnerable to Cross-site Scripting through file preview feature6.1 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be...5.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on...6.1 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow...9.8 Critical
- mattermost serverAn issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API...5.3 Medium
- mattermost serverMattermost Server does not restrict SAML certificate path for System Administrators4.9 Medium
- mattermost serverMattermost Server vulnerable to XSS through channel headers6.1 Medium
- mattermost serverMattermost Server has Improper Authorization for Integration Requests5.3 Medium
- mattermost serverMattermost Server uses weak hashing for OAuth, email verification tokens and invitations7.5 High
- mattermost serverMattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used8.1 High
- mattermost serverMattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider5.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a...6.1 Medium
- mattermost serverMattermost Server password reset email requests can be sent to attacker-provided email addresses9.8 Critical
- mattermost serverAn issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can...5.3 Medium
- mattermost serverMattermost Server server restarts may provide attackers with API access9.8 Critical
- apache archivaInjection in Apache Archiva5.3 Medium
- alpine project alpine, debian linux, fedoraproject fedora +2 moreAlpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in...7.5 High
- mattermost serverMattermost Server SAML implementation does not require encryption or signature verification as default7.5 High
- mattermost serverAn issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications...4.3 Medium
- mattermost serverMattermost Server has X.509 Improper Certificate Validation9.1 Critical
- mattermost serverMattermost Server allows an attacker to specify a full pathname of a log file9.8 Critical
- mattermost serverMattermost Server vulnerable to XSS via an uploaded file6.1 Medium
- mattermost serverMattermost Server vulnerable to CSRF if CORS is enabled8.8 High
- mattermost serverMattermost Server exposes team invite IDs through API endpoints5.3 Medium
- mattermost serverMattermost Server is vulnerable to DoS through maliciously crafted posts5.3 Medium
- mattermost serverMattermost Server is vulnerable CSV Injection9.8 Critical
- mattermost serverMattermost Server does not properly restrict use of slash commands8.8 High
- mattermost serverMattermost Server exposes sensitive user status information via REST API version 4 endpoint5.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via...6.1 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP...5.3 Medium
- mattermost serverMattermost Server exposes team creator's e-mail address to other members5.3 Medium
- Show moreLoading…