Mattermost Server vulnerabilities, page 2
486 vulnerabilities
Known vulnerabilities in Mattermost Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2016-11079github.com/mattermostmattermost-server+1
EPSS score0.69%
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.CVE-2016-11078github.com/mattermostmattermost-server+1EPSS score0.94%
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.CVE-2016-11077github.com/mattermostmattermost-server+1EPSS score0.63%
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.CVE-2016-11083github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.CVE-2016-11081github.com/mattermostmattermost-server+1EPSS score0.75%
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.CVE-2016-11070github.com/mattermostmattermost-server+1EPSS score0.56%
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.CVE-2016-11080github.com/mattermostmattermost-server+1EPSS score0.66%
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.CVE-2016-11074github.com/mattermostmattermost-server+1EPSS score1.18%
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.CVE-2016-11084github.com/mattermostmattermost-server+1EPSS score0.34%
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.CVE-2016-11065mattermostmattermost_serverEPSS score0.63%
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.CVE-2016-11082github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.CVE-2016-11072github.com/mattermostmattermost-server+1EPSS score0.73%
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.CVE-2016-11062mattermostmattermost_serverEPSS score0.81%
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.CVE-2016-11063github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.CVE-2016-11073github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.CVE-2016-11076github.com/mattermostmattermost-server+1EPSS score0.88%
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.CVE-2016-11067github.com/mattermostmattermost-server+1EPSS score1.11%
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.CVE-2016-11075github.com/mattermostmattermost-server+1EPSS score0.93%
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.CVE-2016-11068github.com/mattermostmattermost-server+1EPSS score0.93%
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.CVE-2016-11071github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.