Filter
AND
AND
Versions
Mattermost MattermostUser creation date manipulation in POST /api/v4/users
5.3
First published (updated )
Mattermost MattermostIDOR when marking read a user's channel
4.3
First published (updated )
Mattermost MattermostServer crash via Elasticsearch certificate file
4.9
First published (updated )
Mattermost MattermostEmail addresses of remote users visible in props regardless of server settings
4.3
First published (updated )
Mattermost MattermostMunged email address used for password resets and notifications
6.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
go/github.com/mattermost/mattermost/server/v8Malicious remote can create arbitrary reactions on arbitrary posts
4.3
First published (updated )
Mattermost MattermostLimited DoS due to permitting creating users with user-defined IDs
6.5
EPSS
0.05%
First published (updated )
Mattermost MattermostCreating posts with user-defined IDs permitted in CreatePost API
5.4
First published (updated )
Mattermost MattermostChannel IDs of archived/restored channels leaked via webhook events
5.3
First published (updated )
Mattermost MattermostLack of permission check when updating the profile picture of a remote user (shared channels enabled)
5.3
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostOpen redirect in /oauth/<service>/mobile_login?redirect_to=
6.1
First published (updated )
go/github.com/mattermost/mattermost/server/v8Insecure Direct Object Reference in /plugins/focalboard/ api/v2/users of Mattermost Boards
4.3
EPSS
0.04%
First published (updated )
Mattermost MattermostPermalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
4.3
First published (updated )
Mattermost MattermostLog Flooding due to specially crafted requests in different endpoints
5.3
First published (updated )
Mattermost MattermostHTML injection via channel autocomplete
5.4
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostUsers full name disclosure through Mattermost Boards with Show Full Name Option disabled
4.3
First published (updated )
Mattermost MattermostUsername and Icon override can be used by members when Hardened Mode is enabled
4.3
First published (updated )
Mattermost MattermostDenial of Service via Link Preview in /api/v4/redirect_location
5.3
EPSS
0.05%
First published (updated )
Mattermost MattermostPassword hash in response body after username update
4.9
EPSS
0.05%
First published (updated )
go/github.com/mattermost/mattermost/server/v8Denial of Service via crashing the Calls Plugin
4.3
EPSS
0.04%
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-5522Mobile app freezes when receiving a post with hundreds of emojis
4.3
First published (updated )
Mattermost MattermostFull name disclosure via team top membership with Show Full Name option disabled
4.3
First published (updated )
go/github.com/mattermost/mattermost/server/v8A system/user manager can demote / deactivate another manager
4.3
First published (updated )
Mattermost MattermostA team member can soft delete other teams that they are not part of
6.5
First published (updated )
Mattermost MattermostSystem Role with manage posts permission can read posts of Direct Messages
4.9
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostDoS via Channel Notification Properties
6.5
First published (updated )
Mattermost MattermostIncorrect authorization allows a user manager to update a system admin
6.7
First published (updated )
Mattermost MattermostA guest user can perform various actions on public playbooks
6.5
First published (updated )
Mattermost MattermostAttachment of deleted message in a thread remains accessible and downloadable
4.3
First published (updated )
Mattermost MattermostSpecially crafted search query can cause large log entries in postgres
4.3
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.