Vulnerabilities (CVE)

Filtered by vendor Mattermost Subscribe
Total 323 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2016-11070 1 Mattermost 1 Mattermost Server 2024-11-21 3.5 LOW 5.4 MEDIUM
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
CVE-2016-11069 1 Mattermost 1 Mattermost Server 2024-11-21 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
CVE-2016-11068 1 Mattermost 1 Mattermost Server 2024-11-21 5.0 MEDIUM 5.3 MEDIUM
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
CVE-2016-11067 1 Mattermost 1 Mattermost Server 2024-11-21 5.0 MEDIUM 5.3 MEDIUM
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
CVE-2016-11066 1 Mattermost 1 Mattermost Server 2024-11-21 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
CVE-2016-11065 1 Mattermost 1 Mattermost Server 2024-11-21 4.0 MEDIUM 4.3 MEDIUM
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.
CVE-2016-11064 1 Mattermost 1 Mattermost Desktop 2024-11-21 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
CVE-2016-11063 1 Mattermost 1 Mattermost Server 2024-11-21 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
CVE-2016-11062 1 Mattermost 1 Mattermost Server 2024-11-21 5.0 MEDIUM 5.3 MEDIUM
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
CVE-2015-9548 1 Mattermost 1 Mattermost Server 2024-11-21 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.
CVE-2024-36250 1 Mattermost 1 Mattermost Server 2024-11-14 N/A 4.8 MEDIUM
Mattermost versions 9.11.x <= 9.11.2, and 9.5.x <= 9.5.10 fail to protect the mfa code against replay attacks, which allows an attacker to reuse the MFA code within ~30 seconds
CVE-2024-42000 1 Mattermost 1 Mattermost Server 2024-11-14 N/A 4.3 MEDIUM
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 and 10.0.x <= 10.0.0 fail to properly authorize the requests to /api/v4/channels  which allows a User or System Manager, with "Read Groups" permission but with no access for channels to retrieve details about private channels that they were not a member of by sending a request to /api/v4/channels.
CVE-2024-52032 1 Mattermost 1 Mattermost Server 2024-11-14 N/A 4.3 MEDIUM
Mattermost versions 10.0.x <= 10.0.0 and 9.11.x <= 9.11.2 fail to properly query ElasticSearch when searching for the channel name in channel switcher which allows an attacker to get private channels names of channels that they are not a member of, when Elasticsearch v8 was enabled.
CVE-2024-46872 1 Mattermost 1 Mattermost Server 2024-11-08 N/A 4.6 MEDIUM
Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks
CVE-2024-10214 1 Mattermost 1 Mattermost 2024-11-05 N/A 3.5 LOW
Mattermost versions 9.11.X <= 9.11.1, 9.5.x <= 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings.
CVE-2024-45835 1 Mattermost 1 Mattermost Desktop 2024-11-01 N/A 6.5 MEDIUM
Mattermost Desktop App versions <=5.8.0 fail to sufficiently configure Electron Fuses which allows an attacker to gather Chromium cookies or abuse other misconfigurations via remote/local access.
CVE-2024-39772 1 Mattermost 1 Mattermost Desktop 2024-11-01 N/A 5.3 MEDIUM
Mattermost Desktop App versions <=5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs.
CVE-2024-40884 1 Mattermost 1 Mattermost Server 2024-10-17 N/A 2.7 LOW
Mattermost versions 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 fail to properly enforce permissions which allows a team admin user without "Add Team Members" permission to disable the invite URL.
CVE-2024-43780 1 Mattermost 1 Mattermost Server 2024-10-16 N/A 4.3 MEDIUM
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.0, 9.8.x <= 9.8.2 fail to enforce permissions which allows a guest user with read access to upload files to a channel.
CVE-2024-42497 1 Mattermost 1 Mattermost Server 2024-10-16 N/A 4.9 MEDIUM
Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a user with systems manager role with read-only access to teams to perform write operations on teams.