| CVE-2016-11081 | MITTEL4.3 | An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser. | 19/06/2020 |
| CVE-2016-11080 | MITTEL4.3 | An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details. | 19/06/2020 |
| CVE-2016-11079 | MITTEL6.1 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL. | 19/06/2020 |
| CVE-2016-11078 | MITTEL6.5 | An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI. | 19/06/2020 |
| CVE-2016-11077 | NIEDRIG2.7 | An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account. | 19/06/2020 |
| CVE-2016-11076 | MITTEL5.3 | An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL. | 19/06/2020 |
| CVE-2016-11075 | MITTEL5.3 | An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API. | 19/06/2020 |
| CVE-2016-11074 | KRITISCH9.8 | An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused. | 19/06/2020 |
| CVE-2016-11073 | MITTEL6.1 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting. | 19/06/2020 |
| CVE-2016-11072 | MITTEL6.5 | An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled. | 19/06/2020 |
| CVE-2016-11071 | MITTEL6.1 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place. | 19/06/2020 |
| CVE-2016-11070 | MITTEL5.4 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values. | 19/06/2020 |
| CVE-2016-11069 | HOCH7.5 | An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. | 19/06/2020 |
| CVE-2016-11068 | MITTEL5.3 | An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. | 19/06/2020 |
| CVE-2016-11067 | MITTEL5.3 | An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang. | 19/06/2020 |
| CVE-2016-11066 | HOCH7.5 | An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information. | 19/06/2020 |
| CVE-2016-11065 | MITTEL4.3 | An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance. | 19/06/2020 |
| CVE-2016-11063 | MITTEL6.1 | An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview. | 19/06/2020 |
| CVE-2016-11062 | MITTEL5.3 | An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed. | 19/06/2020 |
| CVE-2015-9548 | HOCH7.5 | An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed. | 19/06/2020 |