github.com/mattermost/mattermost-server/v6 vulnerabilities (Go)
222 vulnerabilities.
github.com/mattermost/mattermost-server/v6GoLDAP Injection in Mattermost Enterprise Edition When Using Active Directory4.1 Mediumgithub.com/mattermost/mattermost-server/v6GoImproper Access Control in Mattermost allows System Managers to view team details despite role restrictions3.1 Lowgithub.com/mattermost/mattermost-server/v6GoBypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server5.4 Mediumgithub.com/mattermost/mattermost-server/v6GoGoogle OAuth Authentication Bypass for Converted Bot Accounts4.2 Mediumgithub.com/mattermost/mattermost-server/v6GoImproper Access Control in Mattermost Channel Member API3.1 Lowgithub.com/mattermost/mattermost-server/v6GoTeam Privacy Settings Authorization Bypass in Mattermost Server5.3 Mediumgithub.com/mattermost/mattermost-server/v6GoSystem Admin Cannot Access Environment settings in System Console While System Manager Can2.7 Lowgithub.com/mattermost/mattermost-server/v6GoImproper access control to group information4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMembers Without Guest Invite Permissions Can Add Guests to Teams4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoRepeated LDAP login failures can lock an LDAP account5.8 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized Playbooks Post Deletion in Mattermost Playbooks Plugin3.1 Lowgithub.com/mattermost/mattermost-server/v6GoDoS in Mattermost Playbooks via Excessive Task Actions6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoWebapp DoS via malicious retrospective post in Playbooks6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized View Access to Archived Channel Member Info4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoWebhook Secret Exposure via Timing attack in MSteams plugin5.3 Mediumgithub.com/mattermost/mattermost-server/v6GoData exfiltration via AI plugin Jira tool3.0 Lowgithub.com/mattermost/mattermost-server/v6GoChannel metadata visible in archived channels despite configuration setting4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users2.2 Lowgithub.com/mattermost/mattermost-server/v6GoUnauthorized AI bot activation via Wrangler plugin3.1 Lowgithub.com/mattermost/mattermost-server/v6GoUnauthorized Bot Login Using Credentials5.4 Mediumgithub.com/mattermost/mattermost-server/v6GoLeaked Metadata of Deleted Files via Bookmark Creation3.1 Lowgithub.com/mattermost/mattermost-server/v6GoSyatem admin profile modification by delegated granular administration role4.7 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized Access to User Activity Logs API by delegated granular administration roles2.7 Lowgithub.com/mattermost/mattermost-server/v6GoBypassing MFA Enforcement on Plugin Endpoints7.5 Highgithub.com/mattermost/mattermost-server/v6GoUnauthorized Bookmark Creation and Modification in Archived Channels4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoMFA Enforcement Bypass in Search APIs4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized Command Execution in Archived Channels4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoUnauthorized Private-to-Public Channel Conversion5.4 Mediumgithub.com/mattermost/mattermost-server/v6GoAuto-Enrollment of Team Admins into Private Channels without explicit consent3.3 Lowgithub.com/mattermost/mattermost-server/v6GoUnauthorized View Access to Site Statistics and Team Statistics4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoArbitrary file read via block duplication in Mattermost Boards9.9 Criticalgithub.com/mattermost/mattermost-server/v6GoArbitrary file read in Mattermost Boards via import & export board archive9.9 Criticalgithub.com/mattermost/mattermost-server/v6GoSession Persistence After User-to-Bot Conversion3.1 Lowgithub.com/mattermost/mattermost-server/v6GoChannel export permitted on archived channel when viewing archived channels is disabled4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoWebapp crash via object that can't be cast to String in Attachment Field6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoInsufficient Input Validation on Post Props6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoInsufficient Input Validation on Post Props6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoWebApp crash via improper validation of proto style in attachments6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoMisleading UI for undefined admin console settings in Calls causes security confusion3.5 Lowgithub.com/mattermost/mattermost-server/v6GoDoS via custom post type for sysconsole plugin readers4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoAccess control flaw for team admins allows unauthorized team additions3.8 Lowgithub.com/mattermost/mattermost-server/v6GoZipbomb DoS via Missing Slack Import Validation6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoDoS via lack of type validation in Calls6.5 Mediumgithub.com/mattermost/mattermost-server/v6GoBypass of "Max failed attempts" restriction via race condition4.8 Mediumgithub.com/mattermost/mattermost-server/v6GoClient-Side Path Traversal Leading to CSRF in Playbooks4.6 Mediumgithub.com/mattermost/mattermost-server/v6GoDoS via Amplified GraphQL Response in Playbooks4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoArbitrary post deletion via Playbooks /ignore-thread endpoint4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoPrivate channel names leaked with Ctrl+K when ElasticSearch is enabled4.3 Mediumgithub.com/mattermost/mattermost-server/v6GoIncorrect Session Creation with Desktop SSO3.5 Lowgithub.com/mattermost/mattermost-server/v6GoDoS via non-string message using permalink embed3.1 Low- Show moreLoading…