CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 19/06/2020 |
| CVE-2018-21250 | MEDIUM6.5 | An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image dimensions. | 19/06/2020 |
| CVE-2018-21249 | LOW3.7 | An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing. | 19/06/2020 |
| CVE-2018-21248 | HIGH7.5 | An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials. | 19/06/2020 |
| CVE-2017-18877 | MEDIUM6.1 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page. | 19/06/2020 |
| CVE-2017-18876 | MEDIUM4.9 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file. | 19/06/2020 |
| CVE-2017-18875 | MEDIUM4.9 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files. | 19/06/2020 |
| CVE-2017-18871 | HIGH7.5 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name. | 19/06/2020 |
| CVE-2017-18870 | MEDIUM4.3 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case. | 19/06/2020 |
| CVE-2019-20874 | HIGH7.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change. | 19/06/2020 |
| CVE-2019-20873 | MEDIUM6.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation. | 19/06/2020 |
| CVE-2019-20872 | MEDIUM5.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services. | 19/06/2020 |
| CVE-2019-20871 | HIGH7.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking. | 19/06/2020 |
| CVE-2019-20870 | MEDIUM4.3 | An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID. | 19/06/2020 |
| CVE-2019-20869 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel. | 19/06/2020 |
| CVE-2019-20868 | HIGH7.5 | An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated. | 19/06/2020 |
| CVE-2019-20867 | MEDIUM5.3 | An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post. | 19/06/2020 |