| CVE-2016-11084 | 中危6.1 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. | 19/06/2020 |
| CVE-2016-11083 | 中危6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. | 19/06/2020 |
| CVE-2016-11082 | 中危6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. | 19/06/2020 |
| CVE-2016-11081 | 中危4.3 | An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser. | 19/06/2020 |
| CVE-2016-11080 | 中危4.3 | An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details. | 19/06/2020 |
| CVE-2016-11079 | 中危6.1 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL. | 19/06/2020 |
| CVE-2016-11078 | 中危6.5 | An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI. | 19/06/2020 |
| CVE-2016-11077 | 低危2.7 | An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account. | 19/06/2020 |
| CVE-2016-11076 | 中危5.3 | An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL. | 19/06/2020 |
| CVE-2016-11075 | 中危5.3 | An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API. | 19/06/2020 |
| CVE-2016-11074 | 严重9.8 | An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused. | 19/06/2020 |
| CVE-2016-11073 | 中危6.1 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting. | 19/06/2020 |
| CVE-2016-11072 | 中危6.5 | An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled. | 19/06/2020 |
| CVE-2016-11071 | 中危6.1 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place. | 19/06/2020 |
| CVE-2016-11070 | 中危5.4 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values. | 19/06/2020 |
| CVE-2016-11069 | 高危7.5 | An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. | 19/06/2020 |
| CVE-2016-11068 | 中危5.3 | An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. | 19/06/2020 |
| CVE-2016-11067 | 中危5.3 | An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang. | 19/06/2020 |
| CVE-2016-11066 | 高危7.5 | An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information. | 19/06/2020 |
| CVE-2016-11063 | 中危6.1 | An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview. | 19/06/2020 |