Filter
AND
Versions
9.5.0
19
8.0.0
18
7.8.0
16
7.9.0
16
7.10.0
15
9.8.0
15
9.9.0
10
7.8.12
9
7.8.4
9
8.1.3
9
7.9.3
8
7.1.0
7
7.1.9
7
9.0.0
7
9.10.0
7
9.7.0
7
7.0.0
6
8.1.0
6
9.0.1
5
9.1.0
5
7.7.3
3
7.8.11
3
7.8.2
3
7.9.1
3
8.0.3
3
8.1.2
3
9.6.0
3
6.4.0
2
6.5.1
2
6.6.0
2
6.6.1
2
6.7.0
2
7.1.4
2
7.1.7
2
7.4.0
2
7.5.0
2
7.5.1
2
7.7.0
2
5.32.0
1
5.34.0
1
5.35.0
1
5.36.0
1
5.38
1
6.0.2
1
6.1
1
6.2.0
1
6.3.0
1
6.3.8
1
7.2.0
1
7.8.3
1
7.9.2
1
9.11.0
1
9.11.1
1
9.5.9
1
Mattermost MattermostMalicious remote can invite itself to an arbitrary local channel
9.6
First published (updated )
Mattermost MattermostOauth authorization codes do not expire when deauthorizing an oauth2 app
9.1
First published (updated )
Mattermost MattermostOne-click Client-Side Path Traversal Leading to CSRF in User Management admin page
8.8
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
go/github.com/mattermost/mattermost/server/v8Permanently local data deletion by malicious remote
8.7
First published (updated )
go/github.com/mattermost/mattermost/server/v8Malicious remote can add users to arbitrary teams and channels
8.7
First published (updated )
Mattermost MattermostTiming attack during remote cluster token comparison when shared channels are enabled
8.1
First published (updated )
Mattermost MattermostLack of server certificate validation in websockets connection
8.1
First published (updated )
Mattermost MattermostMattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user …
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostAn issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party serve…
7.5
First published (updated )
Mattermost MattermostDB username/password revealed in application logs
7.5
First published (updated )
Mattermost MattermostAudit logging fails to sanitize post metadata
7.5
First published (updated )
Mattermost MattermostDenial of Service via specially crafted block fields in Mattermost Boards
7.5
First published (updated )
Mattermost MattermostDenial of Service via Board Import Zip Bomb
7.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
go/github.com/mattermost/mattermost/server/v8Existing local user overwritten by malicious remote
7.4
First published (updated )
Mattermost MattermostSystem Role with edit access to permissions can elevate themselves to system admin
7.2
EPSS
0.05%
First published (updated )
Mattermost MattermostIDOR: Updating a playbook via the Playbooks API
7.1
First published (updated )
Mattermost MattermostIncorrect authorization allows a user manager to update a system admin
6.7
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostLimited DoS due to permitting creating users with user-defined IDs
6.5
EPSS
0.05%
First published (updated )
Mattermost MattermostMunged email address used for password resets and notifications
6.5
First published (updated )
Mattermost MattermostA team member can soft delete other teams that they are not part of
6.5
First published (updated )
Mattermost MattermostDoS via Channel Notification Properties
6.5
First published (updated )
Mattermost MattermostUsers can view the contents of an archived channel when access is explicitly denied by the system admin
6.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Mattermost MattermostTeam Creator's Email Address is disclosed to Team Members via one of the APIs
6.5
First published (updated )
Mattermost MattermostMalicious imports can lead to Denial of Service
6.5
First published (updated )
Mattermost MattermostAuthenticated user could send multiple requests containing a large Auto Responder Message payload and can crash a Mattermost server
6.5
First published (updated )
Mattermost MattermostAuthenticated user could send multiple requests containing a large payload to a Playbooks API and can crash a Mattermost server
6.5
First published (updated )
Mattermost MattermostAuthenticated user could send multiple requests containing a parameter which could fetch a large amount of data and can crash a Mattermost server
6.5
First published (updated )
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.