CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 19/06/2020 |
| CVE-2019-20883 | MEDIUM4.3 | An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post. | 19/06/2020 |
| CVE-2019-20882 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team. | 19/06/2020 |
| CVE-2019-20881 | HIGH7.3 | An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA. | 19/06/2020 |
| CVE-2019-20880 | HIGH7.5 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via OpenGraph. | 19/06/2020 |
| CVE-2019-20879 | MEDIUM4.3 | An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry. | 19/06/2020 |
| CVE-2019-20878 | MEDIUM4.3 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled. | 19/06/2020 |
| CVE-2019-20877 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled. | 19/06/2020 |
| CVE-2019-20876 | MEDIUM5.4 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy. | 19/06/2020 |
| CVE-2019-20875 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed. | 19/06/2020 |
| CVE-2018-21263 | HIGH8.8 | An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response. | 19/06/2020 |
| CVE-2018-21262 | HIGH7.5 | An issue was discovered in Mattermost Server before 4.7.3. It allows attackers to cause a denial of service (application crash) via invalid LaTeX text. | 19/06/2020 |
| CVE-2018-21261 | MEDIUM4.3 | An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. An e-mail invite accidentally included the team invite_id, which leads to unintended excessive invitation privileges. | 19/06/2020 |
| CVE-2018-21260 | LOW2.7 | An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy. | 19/06/2020 |
| CVE-2018-21259 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of service (application hang) via a malformed link in a channel. | 19/06/2020 |
| CVE-2018-21258 | HIGH7.5 | An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command. | 19/06/2020 |
| CVE-2018-21257 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for setting a channel header) via the Channel header slash command API. | 19/06/2020 |