Mattermost vulnerabilities, page 2
663 vulnerabilities
Known vulnerabilities in Mattermost products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 23 products.
CVE-2018-21249mattermostmattermost_server
EPSS score0.73%
An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.CVE-2018-21250mattermostmattermost_serverEPSS score1.08%
An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image dimensions.CVE-2018-21261mattermostmattermost_serverEPSS score0.58%
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges.CVE-2018-21263mattermostmattermost_serverEPSS score0.93%
An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response.CVE-2018-21253mattermostmattermost_serverEPSS score0.58%
An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user.CVE-2018-21264mattermostmattermost_serverEPSS score1.12%
An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response.CVE-2018-21252mattermostmattermost_serverEPSS score0.61%
An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups.CVE-2018-21251mattermostmattermost_serverEPSS score1.20%
An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body.CVE-2018-21262mattermostmattermost_serverEPSS score1.11%
An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text.CVE-2018-21265mattermostmattermost_desktopEPSS score0.77%
An issue was discovered in Mattermost Desktop App before 4.0.0. It mishandled the Same Origin Policy for setPermissionRequestHandler (e.g., video, audio, and notifications).CVE-2018-21260mattermostmattermost_serverEPSS score0.74%
An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy.CVE-2018-21254mattermostmattermost_serverEPSS score0.61%
An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command.CVE-2018-21255mattermostmattermost_serverEPSS score0.58%
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel.CVE-2021-37860github.com/mattermostmattermost-server+2EPSS score0.63%
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.CVE-2021-37864mattermostmattermostEPSS score0.58%
Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs.CVE-2021-37859mattermostmattermostEPSS score3.29%
Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.CVE-2021-37863mattermostmattermost+1EPSS score0.86%
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post.CVE-2021-37861mattermostmattermostEPSS score0.91%
Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.CVE-2021-37866mattermostmattermost_boardsEPSS score0.72%
Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows an attacker to reuse old session token for authorization.CVE-2021-37865mattermostmattermostEPSS score0.90%
Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.