github.com/mattermost/mattermost-server/v5 vulnerabilities (Go)
199 vulnerabilities.
github.com/mattermost/mattermost-server/v5GoLDAP Injection in Mattermost Enterprise Edition When Using Active Directory4.1 Mediumgithub.com/mattermost/mattermost-server/v5GoImproper Access Control in Mattermost allows System Managers to view team details despite role restrictions3.1 Lowgithub.com/mattermost/mattermost-server/v5GoBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server5.4 Mediumgithub.com/mattermost/mattermost-server/v5GoGoogle OAuth Authentication Bypass for Converted Bot Accounts4.2 Mediumgithub.com/mattermost/mattermost-server/v5GoImproper Access Control in Mattermost Channel Member API3.1 Lowgithub.com/mattermost/mattermost-server/v5GoTeam Privacy Settings Authorization Bypass in Mattermost Server5.3 Mediumgithub.com/mattermost/mattermost-server/v5GoSystem Admin Cannot Access Environment settings in System Console While System Manager Can2.7 Lowgithub.com/mattermost/mattermost-server/v5GoImproper access control to group information4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMembers Without Guest Invite Permissions Can Add Guests to Teams4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoRepeated LDAP login failures can lock an LDAP account5.8 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin3.1 Lowgithub.com/mattermost/mattermost-server/v5GoDoS in Mattermost Playbooks via Excessive Task Actions6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoWebapp DoS via malicious retrospective post in Playbooks6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized View Access to Archived Channel Member Info4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoWebhook Secret Exposure via Timing attack in MSteams plugin5.3 Mediumgithub.com/mattermost/mattermost-server/v5GoData exfiltration via AI plugin Jira tool3.0 Lowgithub.com/mattermost/mattermost-server/v5GoChannel metadata visible in archived channels despite configuration setting4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users2.2 Lowgithub.com/mattermost/mattermost-server/v5GoUnauthorized AI bot activation via Wrangler plugin3.1 Lowgithub.com/mattermost/mattermost-server/v5GoUnauthorized Bot Login Using Credentials5.4 Mediumgithub.com/mattermost/mattermost-server/v5GoLeaked Metadata of Deleted Files via Bookmark Creation3.1 Lowgithub.com/mattermost/mattermost-server/v5GoSyatem admin profile modification by delegated granular administration role4.7 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized Access to User Activity Logs API by delegated granular administration roles2.7 Lowgithub.com/mattermost/mattermost-server/v5GoBypassing MFA Enforcement on Plugin Endpoints7.5 Highgithub.com/mattermost/mattermost-server/v5GoUnauthorized Bookmark Creation and Modification in Archived Channels4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoMFA Enforcement Bypass in Search APIs4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized Command Execution in Archived Channels4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoUnauthorized Private-to-Public Channel Conversion5.4 Mediumgithub.com/mattermost/mattermost-server/v5GoAuto-Enrollment of Team Admins into Private Channels without explicit consent3.3 Lowgithub.com/mattermost/mattermost-server/v5GoUnauthorized View Access to Site Statistics and Team Statistics4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoArbitrary file read via block duplication in Mattermost Boards9.9 Criticalgithub.com/mattermost/mattermost-server/v5GoArbitrary file read in Mattermost Boards via import & export board archive9.9 Criticalgithub.com/mattermost/mattermost-server/v5GoSession Persistence After User-to-Bot Conversion3.1 Lowgithub.com/mattermost/mattermost-server/v5GoChannel export permitted on archived channel when viewing archived channels is disabled4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoWebapp crash via object that can't be cast to String in Attachment Field6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoInsufficient Input Validation on Post Props6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoInsufficient Input Validation on Post Props6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoWebApp crash via improper validation of proto style in attachments6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoMisleading UI for undefined admin console settings in Calls causes security confusion3.5 Lowgithub.com/mattermost/mattermost-server/v5GoDoS via custom post type for sysconsole plugin readers4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoAccess control flaw for team admins allows unauthorized team additions3.8 Lowgithub.com/mattermost/mattermost-server/v5GoZipbomb DoS via Missing Slack Import Validation6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoDoS via lack of type validation in Calls6.5 Mediumgithub.com/mattermost/mattermost-server/v5GoBypass of "Max failed attempts" restriction via race condition4.8 Mediumgithub.com/mattermost/mattermost-server/v5GoClient-Side Path Traversal Leading to CSRF in Playbooks4.6 Mediumgithub.com/mattermost/mattermost-server/v5GoDoS via Amplified GraphQL Response in Playbooks4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoArbitrary post deletion via Playbooks /ignore-thread endpoint4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoPrivate channel names leaked with Ctrl+K when ElasticSearch is enabled4.3 Mediumgithub.com/mattermost/mattermost-server/v5GoIncorrect Session Creation with Desktop SSO3.5 Lowgithub.com/mattermost/mattermost-server/v5GoDoS via non-string message using permalink embed3.1 Low- Show moreLoading…