github.com/mattermost/mattermost-server vulnerabilities (Go)
296 vulnerabilities.
github.com/mattermost/mattermost-serverGoMattermost Server: initial_load API exposes unnecessary information7.5 Highgithub.com/mattermost/mattermost-serverGoMattermost Server vulnerable to Cross-site Scripting through file preview feature6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server does not restrict SAML certificate path for System Administrators4.9 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server vulnerable to XSS through channel headers6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server has Improper Authorization for Integration Requests5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server uses weak hashing for OAuth, email verification tokens and invitations7.5 Highgithub.com/mattermost/mattermost-serverGoMattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used8.1 Highgithub.com/mattermost/mattermost-serverGoMattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server password reset email requests can be sent to attacker-provided email addresses9.8 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Server server restarts may provide attackers with API access9.8 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Server SAML implementation does not require encryption or signature verification as default7.5 Highgithub.com/mattermost/mattermost-serverGoMattermost Server has X.509 Improper Certificate Validation9.1 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Server allows an attacker to specify a full pathname of a log file9.8 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Server vulnerable to XSS via an uploaded file6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server vulnerable to CSRF if CORS is enabled8.8 Highgithub.com/mattermost/mattermost-serverGoMattermost Server exposes team invite IDs through API endpoints5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to DoS through maliciously crafted posts5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable CSV Injection9.8 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Server does not properly restrict use of slash commands8.8 Highgithub.com/mattermost/mattermost-serverGoMattermost Server exposes sensitive user status information via REST API version 4 endpoint5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server exposes team creator's e-mail address to other members5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to SQL Injection when executing multiple POST requests9.8 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to XSS through display name field6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server has intermittent Authorization bypass for resource-owners8.1 Highgithub.com/mattermost/mattermost-serverGoMattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server mishandles redirect denial action6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials9.8 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Server exposes private team invite ID5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to webhook and slash command manipulation4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server allows attackers to create buttons that can launch API requests4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server does not neutralize HTML content in an Email template field6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server does not safeguard against phishing via error page links6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server exposes OAuth personal access tokens to attackers8.1 Highgithub.com/mattermost/mattermost-serverGoMattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider9.1 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to XSS through author_link field in Slack attachments6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server allows users with a session ID to revoke another users' session4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to Directory Traversal by System Admins6.5 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to channel invisibility DoS via misformatted post5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names7.5 Highgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to Path Traversal when files are stored locally4.9 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server does not prevent System Admin from arbitrary file creation4.9 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server has mishandled webhook access control4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to a Denial of Service attack through `invite_people` command7.5 Highgithub.com/mattermost/mattermost-serverGoMattermost Server Sensitive Data Exposure5.3 Medium