Skip to contentMattermost Server vulnerabilities
- mattermost, mattermost server +1 moreDisclosure of team owner email address when regenerating Invite IDCVE-2023-27265Fix available2.7 Low
- mattermost, mattermost server +1 moreServer-side Denial of Service while processing a specifically crafted GIF fileCVE-2022-3257Fix available3.1 Low
- mattermost, mattermost server +1 moreServer-side Denial of Service while processing a specifically crafted JPEG fileCVE-2022-3147Fix available3.1 Low
- mattermost, mattermost server +1 moreTeam members could access sensitive information of other users via an API callCVE-2022-2401Fix available6.5 Medium
- mattermost, mattermost server +1 moreIncorrect defaults can cause attackers to bypass rate limitationsCVE-2022-2366Fix available5.6 Medium
- mattermost, mattermost server +1 moreA crafted SVG attachment can crash a Mattermost serverCVE-2022-1982Fix available4.3 Medium
- mattermost, mattermost server +1 moreAuthorized users are allowed to install old plugin versions from the MarketplaceCVE-2022-1384Fix available4.7 Medium
- mattermost, mattermost server +1 moreInvitation Email is resent as a Reminder after invalidating pending email invitesCVE-2022-1385Fix available3.7 Low
- mattermost, mattermost server +1 moreRestricted custom admin role can bypass the restrictions and view the server logs and server config.json file contentsCVE-2022-1332Fix available4.3 Medium
- mattermost, mattermost server +1 moreOOM DoS in Mattermost image proxyCVE-2022-1337Fix available4.3 Medium
- mattermost, mattermost server +1 moreStack overflow in document extractor in MattermostCVE-2022-0904Fix available4.3 Medium
- mattermost, mattermost server +1 moreStack overflow in SAML login in MattermostCVE-2022-0903Fix available5.3 Medium
- mattermost, mattermost server +1 moreMattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which...CVE-2021-37863Fix available3.5 Low
- mattermost, mattermost server +1 moreMattermost 6.0 and earlier fails to sufficiently validate the email address during registration,...CVE-2021-37862Fix available3.7 Low
- mattermost serverAn issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial...CVE-2015-95487.5 High
- mattermost serverMattermost Server allows XSS via CSRFCVE-2016-11084Fix available6.1 Medium
- mattermost serverMattermost Server: Files may be rendered inline instead of downloaded, allowing script executionCVE-2016-11083Fix available6.1 Medium
- mattermost serverMattermost Server is vulnerable to XSS through crafted linksCVE-2016-11082Fix available6.1 Medium
- mattermost serverMattermost Server exposes information stored by a web browserCVE-2016-11081Fix available4.3 Medium
- mattermost serverMattermost Server exposes account details to any Team AdministratorCVE-2016-11080Fix available4.3 Medium
- mattermost serverMattermost Server allows XSS via redirect URLCVE-2016-11079Fix available6.1 Medium
- mattermost serverMattermost Server exposes sensitive information via its System Console UICVE-2016-11078Fix available6.5 Medium
- mattermost serverMattermost Server allows System Admin to modify LDAP account names and email addressesCVE-2016-11077Fix available2.7 Low
- mattermost serverMattermost Server does not check if cookies are used over SSLCVE-2016-11076Fix available5.3 Medium
- mattermost serverMattermost Server exposes sensitive information about team URLs via an APICVE-2016-11075Fix available5.3 Medium
- mattermost serverMattermost Server: Insufficient Password-Reset Link InvalidationCVE-2016-11074Fix available9.8 Critical
- mattermost serverMattermost Server is vulnerable to XSS via a Legal or Support settingCVE-2016-11073Fix available6.1 Medium
- mattermost serverMattermost Server's Session ID and Session Token are potentially compromisedCVE-2016-11072Fix available6.5 Medium
- mattermost serverMattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`CVE-2016-11071Fix available6.1 Medium
- mattermost serverMattermost Server is vulnerable to XSS through customizable theme color-code valuesCVE-2016-11070Fix available5.4 Medium
- mattermost serverMattermost Server does not enforce rate limits on password change attemptsCVE-2016-11069Fix available7.5 High
- mattermost serverMattermost Server is vulnerable to Code Injection through its LDAP fieldsCVE-2016-11068Fix available5.3 Medium
- mattermost serverMattermost Server is vulnerable to Uncontrolled Resource ConsumptionCVE-2016-11067Fix available5.3 Medium
- mattermost serverMattermost Server: initial_load API exposes unnecessary informationCVE-2016-11066Fix available7.5 High
- mattermost serverAn issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket...CVE-2016-110654.3 Medium
- mattermost serverMattermost Server vulnerable to Cross-site Scripting through file preview featureCVE-2016-11063Fix available6.1 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be...CVE-2016-110625.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on...CVE-2017-189216.1 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow...CVE-2017-189209.8 Critical
- mattermost serverAn issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API...CVE-2017-189195.3 Medium
- mattermost serverMattermost Server does not restrict SAML certificate path for System AdministratorsCVE-2017-18918Fix available4.9 Medium
- mattermost serverMattermost Server vulnerable to XSS through channel headersCVE-2017-18907Fix available6.1 Medium
- mattermost serverMattermost Server has Improper Authorization for Integration RequestsCVE-2017-18916Fix available5.3 Medium
- mattermost serverMattermost Server uses weak hashing for OAuth, email verification tokens and invitationsCVE-2017-18917Fix available7.5 High
- mattermost serverMattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is usedCVE-2017-18906Fix available8.1 High
- mattermost serverMattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service providerCVE-2017-18905Fix available5.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a...CVE-2017-189136.1 Medium
- mattermost serverMattermost Server password reset email requests can be sent to attacker-provided email addressesCVE-2017-18908Fix available9.8 Critical
- mattermost serverAn issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can...CVE-2017-189145.3 Medium
- mattermost serverMattermost Server server restarts may provide attackers with API accessCVE-2017-18915Fix available9.8 Critical
- Show moreLoading…