Skip to contentMattermost vulnerabilities
Newest
- mattermost serverMattermost Server SAML implementation does not require encryption or signature verification as defaultCVE-2017-18909Fix available7.5 High
- mattermost serverAn issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications...CVE-2017-189104.3 Medium
- mattermost serverMattermost Server has X.509 Improper Certificate ValidationCVE-2017-18911Fix available9.1 Critical
- mattermost serverMattermost Server allows an attacker to specify a full pathname of a log fileCVE-2017-18912Fix available9.8 Critical
- mattermost serverMattermost Server vulnerable to XSS via an uploaded fileCVE-2017-18904Fix available6.1 Medium
- mattermost serverMattermost Server vulnerable to CSRF if CORS is enabledCVE-2017-18903Fix available8.8 High
- mattermost serverMattermost Server exposes team invite IDs through API endpointsCVE-2017-18902Fix available5.3 Medium
- mattermost serverMattermost Server is vulnerable to DoS through maliciously crafted postsCVE-2017-18898Fix available5.3 Medium
- mattermost serverMattermost Server is vulnerable CSV InjectionCVE-2017-18900Fix available9.8 Critical
- mattermost serverMattermost Server does not properly restrict use of slash commandsCVE-2017-18886Fix available8.8 High
- mattermost serverMattermost Server exposes sensitive user status information via REST API version 4 endpointCVE-2017-18895Fix available5.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via...CVE-2017-188806.1 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP...CVE-2017-188995.3 Medium
- mattermost serverMattermost Server exposes team creator's e-mail address to other membersCVE-2017-18887Fix available5.3 Medium
- mattermost serverMattermost Server is vulnerable to SQL Injection when executing multiple POST requestsCVE-2017-18888Fix available9.8 Critical
- mattermost serverMattermost Server is vulnerable to XSS through display name fieldCVE-2017-18893Fix available6.1 Medium
- mattermost serverMattermost Server has intermittent Authorization bypass for resource-ownersCVE-2017-18894Fix available8.1 High
- mattermost serverMattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpointCVE-2017-18896Fix available5.3 Medium
- mattermost serverMattermost Server mishandles redirect denial actionCVE-2017-18897Fix available6.1 Medium
- mattermost serverMattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentialsCVE-2017-18885Fix available9.8 Critical
- mattermost serverMattermost Server exposes private team invite IDCVE-2017-18901Fix available5.3 Medium
- mattermost serverMattermost Server is vulnerable to webhook and slash command manipulationCVE-2017-18889Fix available4.3 Medium
- mattermost serverMattermost Server allows attackers to create buttons that can launch API requestsCVE-2017-18890Fix available4.3 Medium
- mattermost serverMattermost Server does not neutralize HTML content in an Email template fieldCVE-2017-18892Fix available6.1 Medium
- mattermost serverMattermost Server does not safeguard against phishing via error page linksCVE-2017-18891Fix available6.1 Medium
- mattermost serverMattermost Server exposes OAuth personal access tokens to attackersCVE-2017-18884Fix available8.1 High
- mattermost serverMattermost Server has low entropy for authorization data as an OAuth 2.0 Service ProviderCVE-2017-18883Fix available9.1 Critical
- mattermost serverAn issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via...CVE-2017-188826.1 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via...CVE-2017-188816.1 Medium
- mattermost serverMattermost Server is vulnerable to XSS through author_link field in Slack attachmentsCVE-2017-18879Fix available6.1 Medium
- mattermost serverMattermost Server allows users with a session ID to revoke another users' sessionCVE-2017-18878Fix available4.3 Medium
- mattermost serverMattermost Server is vulnerable to Directory Traversal by System AdminsCVE-2017-18874Fix available6.5 Medium
- mattermost serverMattermost Server is vulnerable to channel invisibility DoS via misformatted postCVE-2017-18873Fix available5.3 Medium
- mattermost serverMattermost Server's OAuth 2.0 service is vulnerable to attack through Missing AuthorizationCVE-2017-18872Fix available4.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers...CVE-2018-212524.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended...CVE-2018-212564.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce...CVE-2018-212648.8 High
- mattermost serverAn issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended...CVE-2018-212575.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite...CVE-2018-212614.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial...CVE-2018-212627.5 High
- mattermost desktopAn issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin...CVE-2018-212655.3 Medium
- mattermost serverMattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field namesCVE-2017-18871Fix available7.5 High
- mattermost serverAn issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote...CVE-2018-212506.5 Medium
- mattermost serverMattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny pageCVE-2017-18877Fix available6.1 Medium
- mattermost serverMattermost Server is vulnerable to Path Traversal when files are stored locallyCVE-2017-18876Fix available4.9 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the...CVE-2018-212554.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access...CVE-2018-212544.3 Medium
- mattermost serverAn issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events...CVE-2018-212602.7 Low
- mattermost serverAn issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be...CVE-2018-212519.8 Critical
- mattermost serverAn issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.CVE-2018-212493.7 Low
- Show moreLoading…