Skip to content
OpenAdvisories

Archive

19 June 2020

Vulnerabilities first published on this day (UTC), newest first.

← May 2020 2020 / June /19 July 2020 →
  1. 138
  2. 256
  3. 3127
  4. 4100
  5. 533
  6. 65
  7. 78
  8. 834
  9. 9222
  10. 1074
  11. 11123
  12. 1228
  13. 13 
  14. 143
  15. 1590
  16. 1653
  17. 1752
  18. 1884
  19. 19193
  20. 202
  21. 218
  22. 2280
  23. 2327
  24. 2466
  25. 2574
  26. 26104
  27. 272
  28. 283
  29. 2972
  30. 3052
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2017-18908

    Mattermost Server password reset email requests can be sent to attacker-provided email addresses

    An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.

    github.com/mattermost/mattermost-server Go
  • Critical 9.8
    CVE-2017-18915

    Mattermost Server server restarts may provide attackers with API access

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.

    github.com/mattermost/mattermost-server Go
  • Critical 9.1
    CVE-2017-18911

    Mattermost Server has X.509 Improper Certificate Validation

    An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.

    github.com/mattermost/mattermost-server Go
  • Critical 9.8
    CVE-2017-18900

    Mattermost Server is vulnerable CSV Injection

    An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.

    github.com/mattermost/mattermost-server Go
  • Critical 9.8
    CVE-2017-18888

    Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.

    github.com/mattermost/mattermost-server Go
  • Critical 9.8
    CVE-2017-18885

    Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.

    github.com/mattermost/mattermost-server Go
  • Critical —
    CVE-2017-18884

    Mattermost Server exposes OAuth personal access tokens to attackers

    An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.

    github.com/mattermost/mattermost-server Go
  • Critical 9.8
    CVE-2020-8165 Public exploit EPSS 46%

    ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

    A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

    rails rails activesupport Debian Ubuntu RubyGems