Security Advisories | GitStock

medium2022-05-24

CVE-2017-18891-Mattermost Server does not safeguard against phishing via error page links

mattermost/mattermost · GHSA-vrh2-rprg-rgc6

critical2022-05-24

CVE-2017-18888-Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests

mattermost/mattermost · GHSA-v2vm-hq26-5jv6

medium2022-05-24

CVE-2017-18890-Mattermost Server allows attackers to create buttons that can launch API requests

mattermost/mattermost · GHSA-m497-hq5x-6jcv

medium2022-05-24

CVE-2017-18895-Mattermost Server exposes sensitive user status information via REST API version 4 endpoint

mattermost/mattermost · GHSA-h742-xx59-r9pq

high2022-05-24

CVE-2017-18894-Mattermost Server has intermittent Authorization bypass for resource-owners

mattermost/mattermost · GHSA-gg42-mwr6-p82c

medium2022-05-24

CVE-2017-18897-Mattermost Server mishandles redirect denial action

mattermost/mattermost · GHSA-f7c3-7vp3-44p6

medium2022-05-24

CVE-2017-18898-Mattermost Server is vulnerable to DoS through maliciously crafted posts

mattermost/mattermost · GHSA-9589-mq83-f749

medium2022-05-24

CVE-2017-18893-Mattermost Server is vulnerable to XSS through display name field

mattermost/mattermost · GHSA-887v-xh2x-47cm

medium2022-05-24

CVE-2017-18896-Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint

mattermost/mattermost · GHSA-63wg-qmrv-7q66

high2022-05-24

CVE-2017-18886-Mattermost Server does not properly restrict use of slash commands

mattermost/mattermost · GHSA-wvjg-33p9-938h

medium2022-05-24

CVE-2017-18889-Mattermost Server is vulnerable to webhook and slash command manipulation

mattermost/mattermost · GHSA-jp57-4x34-5v94

critical2022-05-24

CVE-2017-18885-Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials

mattermost/mattermost · GHSA-g78f-6xq7-rrhq

medium2022-05-24

CVE-2017-18873-Mattermost Server is vulnerable to channel invisibility DoS via misformatted post

mattermost/mattermost · GHSA-x6mw-hf2j-vqpc

medium2022-05-24

CVE-2017-18883-Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

mattermost/mattermost · GHSA-w8cc-3h7q-jhc3

medium2022-05-24

CVE-2017-18876-Mattermost Server is vulnerable to Path Traversal when files are stored locally

mattermost/mattermost · GHSA-hjqh-j6rj-gh8q

medium2022-05-24

CVE-2017-18878-Mattermost Server allows users with a session ID to revoke another users' session

mattermost/mattermost · GHSA-h564-6gc2-fcc6

medium2022-05-24

CVE-2017-18877-Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page

mattermost/mattermost · GHSA-9x8x-w6g5-hx4w

medium2022-05-24

CVE-2017-18875-Mattermost Server does not prevent System Admin from arbitrary file creation

mattermost/mattermost · GHSA-9rr5-q43r-ccv4

medium2022-05-24

CVE-2017-18879-Mattermost Server is vulnerable to XSS through author_link field in Slack attachments

mattermost/mattermost · GHSA-498j-wxww-j897

medium2022-05-24

CVE-2017-18887-Mattermost Server exposes team creator's e-mail address to other members

mattermost/mattermost · GHSA-35c4-5qfp-wxj6