github.com/mattermost/mattermost-server vulnerabilities (Go)
296 vulnerabilities.
github.com/mattermost/mattermost-serverGoDoS via a large number of User Preferences4.3 Mediumgithub.com/mattermost/mattermost-serverGoUsers maintain access to active call after being removed from a channel3.1 Lowgithub.com/mattermost/mattermost-serverGoResource Exhaustion via the Invitation Feature3.1 Lowgithub.com/mattermost/mattermost-serverGoMattermost fails to limit the number of role names4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost incorrectly allows access individual posts3.1 Lowgithub.com/mattermost/mattermost-serverGoMattermost race condition2.6 Lowgithub.com/mattermost/mattermost-serverGoMattermost allows attackers access to posts in channels they are not a member of4.3 Mediumgithub.com/mattermost/mattermost-serverGoExisting server guests invited to the team by members without "invite_guest" permission4.3 Mediumgithub.com/mattermost/mattermost-serverGoExcessive resource consumption when sending long emoji names in user custom status4.3 Mediumgithub.com/mattermost/mattermost-serverGoPublic channel post content accessible without membership when compliance export is enabled4.3 Mediumgithub.com/mattermost/mattermost-serverGoFiles of archived channels accessible with the “Allow users to view archived channels” option disabled3.1 Lowgithub.com/mattermost/mattermost-serverGoTeam associated AD/LDAP Groups Leaked due to missing authorization4.3 Mediumgithub.com/mattermost/mattermost-serverGoDenial of service in mattermost mobile apps and server via emoji reactions4.3 Mediumgithub.com/mattermost/mattermost-serverGoIncorrect Authorization leads to Channel Member Count Leak3.1 Lowgithub.com/mattermost/mattermost-serverGoDetails of archived public channels are leaked to members of another team4.3 Mediumgithub.com/mattermost/mattermost-serverGoLack of restriction to manage group names for freshly demoted guests3.7 Lowgithub.com/mattermost/mattermost-serverGoKeywords that trigger mentions are leaked to other users4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Cross-site Scripting vulnerability3.7 Lowgithub.com/mattermost/mattermost-serverGoPassword hash in response body after username update4.9 Mediumgithub.com/mattermost/mattermost-serverGoInformation disclosure in linked message previews6.5 Mediumgithub.com/mattermost/mattermost-serverGoStored XSS via SVG attachment on Boards7.3 Highgithub.com/mattermost/mattermost-serverGoUnsanitized events sent over Websocket to regular users in a High Availability environment4.3 Mediumgithub.com/mattermost/mattermost-serverGoUnauthorized email invite to a private channel4.2 Mediumgithub.com/mattermost/mattermost-serverGoAuthenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost server3.1 Lowgithub.com/mattermost/mattermost-serverGoAuthenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server4.3 Mediumgithub.com/mattermost/mattermost-serverGoTeam members could access sensitive information of other users via an API call6.5 Mediumgithub.com/mattermost/mattermost-serverGoA crafted SVG attachment can crash a Mattermost server4.3 Mediumgithub.com/mattermost/mattermost-serverGoAuthorized users are allowed to install old plugin versions from the Marketplace4.7 Mediumgithub.com/mattermost/mattermost-serverGoInvitation Email is resent as a Reminder after invalidating pending email invites3.7 Lowgithub.com/mattermost/mattermost-serverGoRestricted custom admin role can bypass the restrictions and view the server logs and server config.json file contents4.3 Mediumgithub.com/mattermost/mattermost-serverGoOOM DoS in Mattermost image proxy4.3 Mediumgithub.com/mattermost/mattermost-serverGoCross-site Scripting in Mattermost3.7 Lowgithub.com/mattermost/mattermost-serverGoMattermost Server allows XSS via CSRF6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server: Files may be rendered inline instead of downloaded, allowing script execution6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to XSS through crafted links6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server exposes information stored by a web browser4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server exposes account details to any Team Administrator4.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server allows XSS via redirect URL6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server exposes sensitive information via its System Console UI6.5 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server allows System Admin to modify LDAP account names and email addresses2.7 Lowgithub.com/mattermost/mattermost-serverGoMattermost Server does not check if cookies are used over SSL5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server exposes sensitive information about team URLs via an API5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server: Insufficient Password-Reset Link Invalidation9.8 Criticalgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to XSS via a Legal or Support setting6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server's Session ID and Session Token are potentially compromised6.5 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`6.1 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to XSS through customizable theme color-code values5.4 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server does not enforce rate limits on password change attempts7.5 Highgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to Code Injection through its LDAP fields5.3 Mediumgithub.com/mattermost/mattermost-serverGoMattermost Server is vulnerable to Uncontrolled Resource Consumption5.3 Medium- Show moreLoading…