Filters
Versions
9.5.0
19
8.0.0
18
7.8.0
16
7.9.0
16
7.10.0
15
9.8.0
15
9.9.0
10
7.8.12
9
7.8.4
9
8.1.3
9
7.9.3
8
7.1.0
7
7.1.9
7
9.0.0
7
9.10.0
7
9.7.0
7
7.0.0
6
8.1.0
6
9.0.1
5
9.1.0
5
7.7.3
3
7.8.11
3
7.8.2
3
7.9.1
3
8.0.3
3
8.1.2
3
9.6.0
3
6.4.0
2
6.5.1
2
6.6.0
2
6.6.1
2
6.7.0
2
7.1.4
2
7.1.7
2
7.4.0
2
7.5.0
2
7.5.1
2
7.7.0
2
5.32.0
1
5.34.0
1
5.35.0
1
5.36.0
1
5.38
1
6.0.2
1
6.1
1
6.2.0
1
6.3.0
1
6.3.8
1
7.2.0
1
7.8.3
1
7.9.2
1
9.11.0
1
9.11.1
1
9.5.9
1
Mattermost MattermostIncorrect Session Creation with Desktop SSO
3.5
First published (updated )
Mattermost MattermostSystem Role with edit access to permissions can elevate themselves to system admin
7.2
EPSS
0.05%
First published (updated )
Mattermost MattermostUser creation date manipulation in POST /api/v4/users
5.3
First published (updated )
Mattermost MattermostOne-click Client-Side Path Traversal Leading to CSRF in User Management admin page
8.8
First published (updated )
Mattermost MattermostIDOR when marking read a user's channel
4.3
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostServer crash via Elasticsearch certificate file
4.9
First published (updated )
Mattermost MattermostEmail addresses of remote users visible in props regardless of server settings
4.3
First published (updated )
Mattermost MattermostMunged email address used for password resets and notifications
6.5
First published (updated )
go/github.com/mattermost/mattermost/server/v8Permanently local data deletion by malicious remote
8.7
First published (updated )
Mattermost MattermostMalicious remote can invite itself to an arbitrary local channel
9.6
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
go/github.com/mattermost/mattermost/server/v8Malicious remote can add users to arbitrary teams and channels
8.7
First published (updated )
go/github.com/mattermost/mattermost/server/v8Existing local user overwritten by malicious remote
7.4
First published (updated )
go/github.com/mattermost/mattermost/server/v8Malicious remote can create arbitrary reactions on arbitrary posts
4.3
First published (updated )
Mattermost MattermostLimited DoS due to permitting creating users with user-defined IDs
6.5
EPSS
0.05%
First published (updated )
Mattermost MattermostRemoteClusterFrame payloads are audit logged in full
2.7
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostCreating posts with user-defined IDs permitted in CreatePost API
5.4
First published (updated )
Mattermost MattermostTiming attack during remote cluster token comparison when shared channels are enabled
8.1
First published (updated )
Mattermost MattermostChannel IDs of archived/restored channels leaked via webhook events
5.3
First published (updated )
Mattermost MattermostLack of permission check when updating the profile picture of a remote user (shared channels enabled)
5.3
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostOpen redirect in /oauth/<service>/mobile_login?redirect_to=
6.1
First published (updated )
go/github.com/mattermost/mattermost/server/v8Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards
4.3
EPSS
0.04%
First published (updated )
Mattermost MattermostPermalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
4.3
First published (updated )
Mattermost MattermostLog Flooding due to specially crafted requests in different endpoints
5.3
First published (updated )
Mattermost MattermostHTML injection via channel autocomplete
5.4
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostDenial of Service via specially crafted block fields in Mattermost Boards
7.5
First published (updated )
Mattermost MattermostDenial of Service via Board Import Zip Bomb
7.5
First published (updated )
Mattermost MattermostUsers full name disclosure through Mattermost Boards with Show Full Name Option disabled
4.3
First published (updated )
Mattermost MattermostUsername and Icon override can be used by members when Hardened Mode is enabled
4.3
First published (updated )
Mattermost MattermostDenial of Service via Link Preview in /api/v4/redirect_location
5.3
EPSS
0.05%
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostPassword hash in response body after username update
4.9
EPSS
0.05%
First published (updated )
Mattermost MattermostDenial of Service via crashing the Calls Plugin
4.3
EPSS
0.04%
First published (updated )
Mattermost MattermostMobile app freezes when receiving a post with hundreds of emojis
4.3
First published (updated )
Mattermost MattermostFull name disclosure via team top membership with Show Full Name option disabled
4.3
First published (updated )
go/github.com/mattermost/mattermost/server/v8A system/user manager can demote / deactivate another manager
4.3
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostA team member can soft delete other teams that they are not part of
6.5
First published (updated )
Mattermost MattermostSystem Role with manage posts permission can read posts of Direct Messages
4.9
First published (updated )
Mattermost MattermostDoS via Channel Notification Properties
6.5
First published (updated )
go/github.com/mattermost/mattermost/server/v8A User Manager role with user edit permissions could manage/update bots
3.8
First published (updated )
Mattermost MattermostAudit logging fails to sanitize post metadata
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostIncorrect authorization allows a user manager to update a system admin
6.7
First published (updated )
Mattermost MattermostA guest user can perform various actions on public playbooks
6.5
First published (updated )
Mattermost MattermostAttachment of deleted message in a thread remains accessible and downloadable
4.3
First published (updated )
Mattermost MattermostLack of server certificate validation in websockets connection
8.1
First published (updated )
Mattermost MattermostSpecially crafted search query can cause large log entries in postgres
4.3
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostDenial of Service while unescaping a Markdown string
6.5
First published (updated )
Mattermost MattermostPath traversal in GitHub plugin's code preview feature
6.5
First published (updated )
Mattermost MattermostStack exhaustion in PreparePostForClientWithEmbedsAndImages
6.5
First published (updated )
Mattermost MattermostEphemeral messages return private channel contents in permalink previews
6.5
First published (updated )
Mattermost MattermostPlaybooks lets you edit arbitrary posts
4.3
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.