Archive
19 June 2020
Vulnerabilities first published on this day (UTC), newest first.
54 results · Clear filters · Feed
-
Medium 5.3
Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to vie…
-
Medium 5.3
Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Ama…
-
Medium 6.1
Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially craf…
-
Medium 4.3
User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification
-
Medium 6.1
Mattermost Server allows XSS via CSRF
An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
-
Medium 6.1
Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
-
Medium 6.1
Mattermost Server is vulnerable to XSS through crafted links
An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
-
Medium 4.3
Mattermost Server exposes information stored by a web browser
An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.
-
Medium —
Mattermost Server exposes account details to any Team Administrator
An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
-
Medium 6.1
Mattermost Server allows XSS via redirect URL
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
-
Medium 6.5
Mattermost Server exposes sensitive information via its System Console UI
An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
-
Medium 5.3
Mattermost Server exposes sensitive information about team URLs via an API
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
-
Medium 6.1
Mattermost Server is vulnerable to XSS via a Legal or Support setting
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
-
Medium 6.5
Mattermost Server's Session ID and Session Token are potentially compromised
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
-
Medium 6.1
Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener`
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
-
Medium 5.4
Mattermost Server is vulnerable to XSS through customizable theme color-code values
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
-
Medium 5.3
Mattermost Server is vulnerable to Code Injection through its LDAP fields
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
-
Medium 5.3
Mattermost Server is vulnerable to Uncontrolled Resource Consumption
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
-
Medium 6.1
Mattermost Server vulnerable to Cross-site Scripting through file preview feature
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
-
Medium 4.9
Mattermost Server does not restrict SAML certificate path for System Administrators
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
-
Medium 6.1
Mattermost Server vulnerable to XSS through channel headers
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
-
Medium —
Mattermost Server has Improper Authorization for Integration Requests
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
-
Medium 5.3
Mattermost Server has Insufficient Session Expiration when used as an OAuth 2.0 service provider
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
-
Medium 5.3CVE-2020-9495 Public exploit
Injection in Apache Archiva
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LD…
-
Medium 6.1
Mattermost Server vulnerable to XSS via an uploaded file
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.
-
Medium 5.3
Mattermost Server exposes team invite IDs through API endpoints
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.
-
Medium 5.3
Mattermost Server is vulnerable to DoS through maliciously crafted posts
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.
-
Medium 5.3
Mattermost Server exposes sensitive user status information via REST API version 4 endpoint
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.
-
Medium 5.3
Mattermost Server exposes team creator's e-mail address to other members
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
-
Medium 6.1
Mattermost Server is vulnerable to XSS through display name field
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.
-
Medium 5.3
Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.
-
Medium 6.1
Mattermost Server mishandles redirect denial action
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.
-
Medium 5.3
Mattermost Server exposes private team invite ID
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.
-
Medium 4.3
Mattermost Server is vulnerable to webhook and slash command manipulation
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.
-
Medium 4.3
Mattermost Server allows attackers to create buttons that can launch API requests
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.
-
Medium 6.1
Mattermost Server does not neutralize HTML content in an Email template field
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.
-
Medium 6.1
Mattermost Server does not safeguard against phishing via error page links
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.
-
Medium —
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
-
Medium 6.1
Mattermost Server is vulnerable to XSS through author_link field in Slack attachments
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
-
Medium 4.3
Mattermost Server allows users with a session ID to revoke another users' session
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.