CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
An issue was discovered in Mattermost Server before 5.1. Non-members of a channel could use the Channel PATCH API to modify that channel. |
| 19/06/2020 |
| CVE-2018-21254 | 보통4.3 | An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-message channel creation) via the Message slash command. | 19/06/2020 |
| CVE-2018-21253 | 보통4.3 | An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user. | 19/06/2020 |
| CVE-2018-21251 | 심각9.8 | An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body. | 19/06/2020 |
| CVE-2018-21250 | 보통6.5 | An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a denial of service (memory consumption) via crafted image dimensions. | 19/06/2020 |
| CVE-2018-21249 | 낮음3.7 | An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing. | 19/06/2020 |
| CVE-2018-21248 | 높음7.5 | An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials. | 19/06/2020 |
| CVE-2017-18877 | 보통6.1 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page. | 19/06/2020 |
| CVE-2017-18876 | 보통4.9 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file. | 19/06/2020 |
| CVE-2017-18875 | 보통4.9 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files. | 19/06/2020 |
| CVE-2017-18871 | 높음7.5 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name. | 19/06/2020 |
| CVE-2017-18870 | 보통4.3 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case. | 19/06/2020 |
| CVE-2019-20874 | 높음7.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change. | 19/06/2020 |
| CVE-2019-20873 | 보통6.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation. | 19/06/2020 |
| CVE-2019-20872 | 보통5.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services. | 19/06/2020 |
| CVE-2019-20871 | 높음7.5 | An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking. | 19/06/2020 |
| CVE-2019-20870 | 보통4.3 | An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID. | 19/06/2020 |