CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2021-37862 | 中危5.4 | Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into signing up using attacker-controlled email addresses via crafted invitation token. | 17/12/2021 |
| CVE-2017-18921 | 中危6.1 | An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page. | 19/06/2020 |
| CVE-2017-18920 | 严重9.8 | An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy. | 19/06/2020 |
| CVE-2017-18919 | 中危5.3 | An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation. | 19/06/2020 |
| CVE-2017-18918 | 中危4.9 | An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname. | 19/06/2020 |
| CVE-2017-18917 | 高危7.5 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens. | 19/06/2020 |
| CVE-2017-18916 | 中危5.3 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction. | 19/06/2020 |
| CVE-2017-18915 | 严重9.8 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access. | 19/06/2020 |
| CVE-2017-18914 | 中危5.3 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist. | 19/06/2020 |
| CVE-2017-18913 | 中危6.1 | An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page. | 19/06/2020 |
| CVE-2017-18908 | 严重9.8 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address. | 19/06/2020 |
| CVE-2017-18907 | 中危6.1 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header. | 19/06/2020 |
| CVE-2017-18906 | 高危8.1 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account. | 19/06/2020 |
| CVE-2017-18905 | 中危5.3 | An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. | 19/06/2020 |
| CVE-2016-11084 | 中危6.1 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. | 19/06/2020 |
| CVE-2016-11083 | 中危6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. | 19/06/2020 |
| CVE-2016-11082 | 中危6.1 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. | 19/06/2020 |