CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2021-37862 |
| MEDIUM5.4 |
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token. |
| 17/12/2021 |
| CVE-2017-18921 | MEDIUM6.1 | An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page. | 19/06/2020 |
| CVE-2017-18920 | CRITICAL9.8 | An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy. | 19/06/2020 |
| CVE-2017-18919 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation. | 19/06/2020 |
| CVE-2017-18918 | MEDIUM4.9 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname. | 19/06/2020 |
| CVE-2017-18917 | HIGH7.5 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens. | 19/06/2020 |
| CVE-2017-18916 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction. | 19/06/2020 |
| CVE-2017-18915 | CRITICAL9.8 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access. | 19/06/2020 |
| CVE-2017-18914 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist. | 19/06/2020 |
| CVE-2017-18913 | MEDIUM6.1 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page. | 19/06/2020 |
| CVE-2017-18908 | CRITICAL9.8 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address. | 19/06/2020 |
| CVE-2017-18907 | MEDIUM6.1 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header. | 19/06/2020 |
| CVE-2017-18906 | HIGH8.1 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account. | 19/06/2020 |
| CVE-2017-18905 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. | 19/06/2020 |
| CVE-2016-11084 | MEDIUM6.1 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. | 19/06/2020 |
| CVE-2016-11083 | MEDIUM6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. | 19/06/2020 |
| CVE-2016-11082 | MEDIUM6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. | 19/06/2020 |