CVEs (452)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 8.1 HIGH· v3 4.9 MEDIUM· v2 An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI. |
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 6.5 MEDIUM· v3 6.4 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place. |
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. |
1Mattermost 1Mattermost Server Nov 21, 2024 Jun 19, 2020 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. |