← Back

Mattermost

mattermost

602 CVEs • 15 products

Products (15)

Click to collapse
Toggle
Mattermost Server
mattermost_server
452 CVEs
Mattermost
mattermost
78 CVEs
Mattermost Desktop
mattermost_desktop
28 CVEs
Mattermost Mobile
mattermost_mobile
20 CVEs
Confluence
confluence
14 CVEs
Mattermost Boards
mattermost_boards
2 CVEs
Playbooks
playbooks
2 CVEs
Ms Teams
ms_teams
2 CVEs
Zoom
zoom
2 CVEs
Focalboard
focalboard
2 CVEs
Mattermost Packages
mattermost_packages
1 CVE
Mattermost Plugins
mattermost_plugins
1 CVE
Mattermost Channel Export
mattermost_channel_export
1 CVE
Channel Export
channel_export
1 CVE
Legal Hold
legal_hold
1 CVE

CVEs (602)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-37861
1Mattermost
1Mattermost
Jun 17, 2026
Dec 9, 2021
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.
CVE-2021-37860
1Mattermost
1Mattermost
Jun 17, 2026
Sep 22, 2021
N/A· v4
6.1 MEDIUM· v3
2.6 LOW· v2
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
CVE-2021-37859
1Mattermost
1Mattermost
Jun 17, 2026
Aug 5, 2021
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.
CVE-2020-13891
1Mattermost
1Mattermost
Jun 17, 2026
Jun 26, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022.
CVE-2017-18921
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
CVE-2017-18920
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.
CVE-2017-18919
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.
CVE-2017-18918
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
CVE-2017-18917
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
CVE-2017-18916
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
CVE-2017-18915
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
CVE-2017-18914
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.
CVE-2017-18913
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.
CVE-2017-18908
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.
CVE-2017-18907
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
CVE-2017-18906
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
8.1 HIGH· v3
4.9 MEDIUM· v2
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
CVE-2017-18905
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
CVE-2016-11084
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
CVE-2016-11083
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
CVE-2016-11082
1Mattermost
1Mattermost Server
Nov 21, 2024
Jun 19, 2020
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.