github.com/mattermost/mattermost-server/v6 vulnerabilities (Go)
222 vulnerabilities.
github.com/mattermost/mattermost-server/v6GoUnauthorized channel file upload4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoInsufficient permissions checks on teams6.0 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized disabling of invite URL2.7 Lowgithub.com/mattermost/mattermost-server/v6GoSystem Role with edit access to permissions can elevate themselves to system admin4.7 Mediumgithub.com/mattermost/mattermost-server/v6GoOne-click Client-Side Path Traversal Leading to CSRF in User Management admin page4.6 Mediumgithub.com/mattermost/mattermost-server/v6GoEmail addresses of remote users visible in props regardless of server settings4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMunged email address used for password resets and notifications4.8 Mediumgithub.com/mattermost/mattermost-server/v6GoMalicious remote can claim that a user was synced from another remote2.7 Lowgithub.com/mattermost/mattermost-server/v6GoMalicious remote can make an arbitrary local channel read-only4.1 Mediumgithub.com/mattermost/mattermost-server/v6GoMalicious remote can create/update/delete arbitrary posts in arbitrary channels5.5 Mediumgithub.com/mattermost/mattermost-server/v6GoRemote username set to an arbitrary string by remote user4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMalicious remote can create arbitrary channels3.8 Lowgithub.com/mattermost/mattermost-server/v6GoPermanently local data deletion by malicious remote6.8 Mediumgithub.com/mattermost/mattermost-server/v6GoMalicious remote can invite itself to an arbitrary local channel8.7 Highgithub.com/mattermost/mattermost-server/v6GoMalicious remote can add users to arbitrary teams and channels8.7 Highgithub.com/mattermost/mattermost-server/v6GoExisting local user overwritten by malicious remote7.4 Highgithub.com/mattermost/mattermost-server/v6GoMalicious remote can create arbitrary reactions on arbitrary posts2.7 Lowgithub.com/mattermost/mattermost-server/v6GoMattermost fails to authenticate the source of certain types of post actions6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoInvite ID available to team admins even without the "Add Members" permission4.7 Mediumgithub.com/mattermost/mattermost-server/v6GoDoS via a large number of User Preferences4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoUsers maintain access to active call after being removed from a channel3.1 Lowgithub.com/mattermost/mattermost-server/v6GoResource Exhaustion via the Invitation Feature3.1 Lowgithub.com/mattermost/mattermost-server/v6GoMattermost fails to limit the number of role names4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMattermost incorrectly allows access individual posts3.1 Lowgithub.com/mattermost/mattermost-server/v6GoMattermost race condition2.6 Lowgithub.com/mattermost/mattermost-server/v6GoMattermost allows attackers access to posts in channels they are not a member of4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoExisting server guests invited to the team by members without "invite_guest" permission4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoExcessive resource consumption when sending long emoji names in user custom status4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoPublic channel post content accessible without membership when compliance export is enabled4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoFiles of archived channels accessible with the “Allow users to view archived channels” option disabled3.1 Lowgithub.com/mattermost/mattermost-server/v6GoTeam associated AD/LDAP Groups Leaked due to missing authorization4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoDenial of service in mattermost mobile apps and server via emoji reactions4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoIncorrect Authorization leads to Channel Member Count Leak3.1 Lowgithub.com/mattermost/mattermost-server/v6GoDetails of archived public channels are leaked to members of another team4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoLack of restriction to manage group names for freshly demoted guests3.7 Lowgithub.com/mattermost/mattermost-server/v6GoKeywords that trigger mentions are leaked to other users4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMattermost Cross-site Scripting vulnerability3.7 Lowgithub.com/mattermost/mattermost-server/v6GoPublic endpoint /metrics of Calls plugin reveals channel IDs5.3 Mediumgithub.com/mattermost/mattermost-server/v6GoClient side path traversal due to lack of route parameters validation7.1 Highgithub.com/mattermost/mattermost-server/v6GoOpen redirect in /oauth/<service>/mobile_login?redirect_to=4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoInsecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoPermalink previews displayed for posts in archived channels even if users are disallowed to view archived channels4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoLog Flooding due to specially crafted requests in different endpoints4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoHTML injection via channel autocomplete3.1 Lowgithub.com/mattermost/mattermost-server/v6GoDenial of Service via specially crafted block fields in Mattermost Boards4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoDenial of Service via Board Import Zip Bomb4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoUsers full name disclosure through Mattermost Boards with Show Full Name Option disabled4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoUsername and Icon override can be used by members when Hardened Mode is enabled4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoDenial of Service via Link Preview in /api/v4/redirect_location5.3 Mediumgithub.com/mattermost/mattermost-server/v6GoPassword hash in response body after username update4.9 Medium- Show moreLoading…