github.com/mattermost/mattermost-server/v5 vulnerabilities (Go)
199 vulnerabilities.
github.com/mattermost/mattermost-server/v5GoUnauthorized channel file upload4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoInsufficient permissions checks on teams6.0 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized disabling of invite URL2.7 Lowgithub.com/mattermost/mattermost-server/v5GoSystem Role with edit access to permissions can elevate themselves to system admin4.7 Mediumgithub.com/mattermost/mattermost-server/v5GoOne-click Client-Side Path Traversal Leading to CSRF in User Management admin page4.6 Mediumgithub.com/mattermost/mattermost-server/v5GoEmail addresses of remote users visible in props regardless of server settings4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMunged email address used for password resets and notifications4.8 Mediumgithub.com/mattermost/mattermost-server/v5GoMalicious remote can claim that a user was synced from another remote2.7 Lowgithub.com/mattermost/mattermost-server/v5GoMalicious remote can make an arbitrary local channel read-only4.1 Mediumgithub.com/mattermost/mattermost-server/v5GoMalicious remote can create/update/delete arbitrary posts in arbitrary channels5.5 Mediumgithub.com/mattermost/mattermost-server/v5GoRemote username set to an arbitrary string by remote user4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMalicious remote can create arbitrary channels3.8 Lowgithub.com/mattermost/mattermost-server/v5GoPermanently local data deletion by malicious remote6.8 Mediumgithub.com/mattermost/mattermost-server/v5GoMalicious remote can invite itself to an arbitrary local channel8.7 Highgithub.com/mattermost/mattermost-server/v5GoMalicious remote can add users to arbitrary teams and channels8.7 Highgithub.com/mattermost/mattermost-server/v5GoExisting local user overwritten by malicious remote7.4 Highgithub.com/mattermost/mattermost-server/v5GoMalicious remote can create arbitrary reactions on arbitrary posts2.7 Lowgithub.com/mattermost/mattermost-server/v5GoMattermost fails to authenticate the source of certain types of post actions6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoInvite ID available to team admins even without the "Add Members" permission4.7 Mediumgithub.com/mattermost/mattermost-server/v5GoDoS via a large number of User Preferences4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoUsers maintain access to active call after being removed from a channel3.1 Lowgithub.com/mattermost/mattermost-server/v5GoResource Exhaustion via the Invitation Feature3.1 Lowgithub.com/mattermost/mattermost-server/v5GoMattermost fails to limit the number of role names4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMattermost incorrectly allows access individual posts3.1 Lowgithub.com/mattermost/mattermost-server/v5GoMattermost race condition2.6 Lowgithub.com/mattermost/mattermost-server/v5GoMattermost allows attackers access to posts in channels they are not a member of4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoExisting server guests invited to the team by members without "invite_guest" permission4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoExcessive resource consumption when sending long emoji names in user custom status4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoPublic channel post content accessible without membership when compliance export is enabled4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoFiles of archived channels accessible with the “Allow users to view archived channels” option disabled3.1 Lowgithub.com/mattermost/mattermost-server/v5GoTeam associated AD/LDAP Groups Leaked due to missing authorization4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoDenial of service in mattermost mobile apps and server via emoji reactions4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoIncorrect Authorization leads to Channel Member Count Leak3.1 Lowgithub.com/mattermost/mattermost-server/v5GoDetails of archived public channels are leaked to members of another team4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoLack of restriction to manage group names for freshly demoted guests3.7 Lowgithub.com/mattermost/mattermost-server/v5GoKeywords that trigger mentions are leaked to other users4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMattermost Cross-site Scripting vulnerability3.7 Lowgithub.com/mattermost/mattermost-server/v5GoPassword hash in response body after username update4.9 Mediumgithub.com/mattermost/mattermost-server/v5GoStored XSS via SVG attachment on Boards7.3 Highgithub.com/mattermost/mattermost-server/v5GoUnsanitized events sent over Websocket to regular users in a High Availability environment4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized email invite to a private channel4.2 Mediumgithub.com/mattermost/mattermost-server/v5GoTeam members could access sensitive information of other users via an API call6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoAuthorized users are allowed to install old plugin versions from the Marketplace4.7 Mediumgithub.com/mattermost/mattermost-server/v5GoInvitation Email is resent as a Reminder after invalidating pending email invites3.7 Lowgithub.com/mattermost/mattermost-server/v5GoRestricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoOOM DoS in Mattermost image proxy4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoCross-site Scripting in Mattermost3.7 Lowgithub.com/mattermost/mattermost-server/v5GoMattermost Server is vulnerable to a Denial of Service attack through `invite_people` command7.5 Highgithub.com/mattermost/mattermost-server/v5GoMattermost Server Sensitive Data Exposure5.3 Medium