| CVE-2016-11084 | MEDIO6.1 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. | 19/06/2020 |
| CVE-2016-11083 | MEDIO6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. | 19/06/2020 |
| CVE-2016-11082 | MEDIO6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. | 19/06/2020 |
| CVE-2016-11081 | MEDIO4.3 | An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser. | 19/06/2020 |
| CVE-2016-11080 | MEDIO4.3 | An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details. | 19/06/2020 |
| CVE-2016-11079 | MEDIO6.1 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL. | 19/06/2020 |
| CVE-2016-11078 | MEDIO6.5 | An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI. | 19/06/2020 |
| CVE-2016-11077 | BAJO2.7 | An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account. | 19/06/2020 |
| CVE-2016-11076 | MEDIO5.3 | An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL. | 19/06/2020 |
| CVE-2016-11075 | MEDIO5.3 | An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API. | 19/06/2020 |
| CVE-2016-11074 | CRÍTICO9.8 | An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused. | 19/06/2020 |
| CVE-2016-11073 | MEDIO6.1 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting. | 19/06/2020 |
| CVE-2016-11072 | MEDIO6.5 | An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled. | 19/06/2020 |
| CVE-2016-11071 | MEDIO6.1 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place. | 19/06/2020 |
| CVE-2016-11070 | MEDIO5.4 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values. | 19/06/2020 |
| CVE-2016-11069 | ALTO7.5 | An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. | 19/06/2020 |
| CVE-2016-11068 | MEDIO5.3 | An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. | 19/06/2020 |
| CVE-2016-11067 | MEDIO5.3 | An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang. | 19/06/2020 |
| CVE-2016-11066 | ALTO7.5 | An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information. | 19/06/2020 |
| CVE-2016-11063 | MEDIO6.1 | An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview. | 19/06/2020 |