| CVE-2018-21255 | MOYENNE4.3 | An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel. | 19/06/2020 |
| CVE-2018-21254 | MOYENNE4.3 | An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command. | 19/06/2020 |
| CVE-2018-21253 | MOYENNE4.3 | An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user. | 19/06/2020 |
| CVE-2018-21251 | CRITIQUE9.8 | An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body. | 19/06/2020 |
| CVE-2018-21250 | MOYENNE6.5 | An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image dimensions. | 19/06/2020 |
| CVE-2018-21249 | FAIBLE3.7 | An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing. | 19/06/2020 |
| CVE-2018-21248 | ÉLEVÉE7.5 | An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials. | 19/06/2020 |
| CVE-2017-18877 | MOYENNE6.1 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page. | 19/06/2020 |
| CVE-2017-18876 | MOYENNE4.9 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file. | 19/06/2020 |
| CVE-2017-18875 | MOYENNE4.9 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files. | 19/06/2020 |
| CVE-2017-18871 | ÉLEVÉE7.5 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name. | 19/06/2020 |
| CVE-2017-18870 | MOYENNE4.3 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case. | 19/06/2020 |
| CVE-2019-20874 | ÉLEVÉE7.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change. | 19/06/2020 |
| CVE-2019-20873 | MOYENNE6.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation. | 19/06/2020 |
| CVE-2019-20872 | MOYENNE5.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services. | 19/06/2020 |
| CVE-2019-20871 | ÉLEVÉE7.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking. | 19/06/2020 |
| CVE-2019-20870 | MOYENNE4.3 | An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID. | 19/06/2020 |
| CVE-2019-20869 | MOYENNE5.3 | An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel. | 19/06/2020 |
| CVE-2019-20868 | ÉLEVÉE7.5 | An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated. | 19/06/2020 |
| CVE-2019-20867 | MOYENNE5.3 | An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post. | 19/06/2020 |