CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 19/06/2020 |
| CVE-2019-20860 | MÉDIO5.5 | An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG document. | 19/06/2020 |
| CVE-2019-20859 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input. | 19/06/2020 |
| CVE-2019-20858 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL LIKE clause to an APIv4 endpoint. | 19/06/2020 |
| CVE-2019-20857 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backtick characters. | 19/06/2020 |
| CVE-2019-20855 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment migration. | 19/06/2020 |
| CVE-2019-20854 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX message. | 19/06/2020 |
| CVE-2020-14460 | MÉDIO6.5 | An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001. | 19/06/2020 |
| CVE-2020-14459 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002. | 19/06/2020 |
| CVE-2020-14458 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004. | 19/06/2020 |
| CVE-2020-14457 | MÉDIO5.3 | An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012. | 19/06/2020 |
| CVE-2020-14453 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005. | 19/06/2020 |
| CVE-2020-14452 | MÉDIO5.3 | An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014. | 19/06/2020 |
| CVE-2020-14450 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-0017. | 19/06/2020 |
| CVE-2020-14448 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0020. | 19/06/2020 |
| CVE-2020-14447 | ALTO7.5 | An issue was discovered in Mattermost Server before 5.23.0. Large webhook requests allow attackers to cause a denial of service (infinite loop), aka MMSA-2020-0021. | 19/06/2020 |
| CVE-2019-20847 | MÉDIO5.3 | An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel. | 19/06/2020 |