Mattermost vulnerabilities, page 3
663 vulnerabilities
Known vulnerabilities in Mattermost products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 23 products.
CVE-2021-37867mattermostmattermost_boards
EPSS score0.67%
Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenticated and unauthorized users to access this information resulting in sensitive & private information disclosure.CVE-2021-37862mattermostmattermost+1EPSS score0.69%
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token.CVE-2015-9548mattermostmattermost_serverEPSS score1.09%
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.CVE-2016-11079github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.CVE-2016-11078github.com/mattermostmattermost-server+1EPSS score0.94%
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.CVE-2016-11077github.com/mattermostmattermost-server+1EPSS score0.63%
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.CVE-2016-11064mattermostmattermost_desktopEPSS score1.29%
An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.CVE-2016-11083github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.CVE-2016-11081github.com/mattermostmattermost-server+1EPSS score0.75%
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.CVE-2016-11070github.com/mattermostmattermost-server+1EPSS score0.56%
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.CVE-2016-11080github.com/mattermostmattermost-server+1EPSS score0.66%
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.CVE-2016-11074github.com/mattermostmattermost-server+1EPSS score1.18%
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.CVE-2016-11084github.com/mattermostmattermost-server+1EPSS score0.34%
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.CVE-2016-11065mattermostmattermost_serverEPSS score0.63%
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.CVE-2016-11082github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.CVE-2016-11072github.com/mattermostmattermost-server+1EPSS score0.73%
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.CVE-2016-11062mattermostmattermost_serverEPSS score0.81%
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.CVE-2016-11063github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.CVE-2016-11073github.com/mattermostmattermost-server+1EPSS score0.69%
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.CVE-2016-11076github.com/mattermostmattermost-server+1EPSS score0.88%
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.