CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2021-37862 | 보통5.4 | Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token. | 17/12/2021 |
| CVE-2017-18921 | 보통6.1 | An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page. | 19/06/2020 |
| CVE-2017-18920 | 심각9.8 | An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy. | 19/06/2020 |
| CVE-2017-18919 | 보통5.3 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation. | 19/06/2020 |
| CVE-2017-18918 | 보통4.9 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname. | 19/06/2020 |
| CVE-2017-18917 | 높음7.5 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens. | 19/06/2020 |
| CVE-2017-18916 | 보통5.3 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction. | 19/06/2020 |
| CVE-2017-18915 | 심각9.8 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access. | 19/06/2020 |
| CVE-2017-18914 | 보통5.3 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist. | 19/06/2020 |
| CVE-2017-18913 | 보통6.1 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page. | 19/06/2020 |
| CVE-2017-18908 | 심각9.8 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address. | 19/06/2020 |
| CVE-2017-18907 | 보통6.1 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header. | 19/06/2020 |
| CVE-2017-18906 | 높음8.1 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account. | 19/06/2020 |
| CVE-2017-18905 | 보통5.3 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. | 19/06/2020 |
| CVE-2016-11084 | 보통6.1 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. | 19/06/2020 |
| CVE-2016-11083 | 보통6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. | 19/06/2020 |
| CVE-2016-11082 | 보통6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. | 19/06/2020 |