CVE 検索
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
公開されているすべての CVE とオープンソースのセキュリティアドバイザリ（NVD、OSV、GitHub）を、CVSS、EPSS、実際に悪用されているか（CISA KEV）とともに掲載しています。数時間ごとに更新されます。スキャンでは、検出した技術とこれらを照合します。
| 中5.4 |
Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token. |
| 17/12/2021 |
| CVE-2017-18921 | 中6.1 | An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page. | 19/06/2020 |
| CVE-2017-18920 | 緊急9.8 | An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy. | 19/06/2020 |
| CVE-2017-18919 | 中5.3 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation. | 19/06/2020 |
| CVE-2017-18918 | 中4.9 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname. | 19/06/2020 |
| CVE-2017-18917 | 高7.5 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens. | 19/06/2020 |
| CVE-2017-18916 | 中5.3 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction. | 19/06/2020 |
| CVE-2017-18915 | 緊急9.8 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access. | 19/06/2020 |
| CVE-2017-18914 | 中5.3 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist. | 19/06/2020 |
| CVE-2017-18913 | 中6.1 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page. | 19/06/2020 |
| CVE-2017-18908 | 緊急9.8 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address. | 19/06/2020 |
| CVE-2017-18907 | 中6.1 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header. | 19/06/2020 |
| CVE-2017-18906 | 高8.1 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account. | 19/06/2020 |
| CVE-2017-18905 | 中5.3 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. | 19/06/2020 |
| CVE-2016-11084 | 中6.1 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. | 19/06/2020 |
| CVE-2016-11083 | 中6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. | 19/06/2020 |
| CVE-2016-11082 | 中6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. | 19/06/2020 |