Archive
June 2020
Vulnerabilities first published in this month (UTC), newest first.
1,813 results · Feed
-
Unscored —
An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.
-
Medium —
Mattermost Server does not prevent System Admin from arbitrary file creation
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
-
Unscored —
CVE-2017-18870 in github.com/mattermost/mattermost-server
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.
-
Unscored —
An issue was discovered in Mattermost Server before 4.10.1, 4.9.4, and 4.8.2. It allows attackers to cause a denial of …
-
Unscored —
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-a…
-
Unscored —
An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication crede…
-
Unscored —
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denia…
-
Unscored —
An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin.
-
Unscored —
An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a differ…
-
High 7.5
Mattermost Server is vulnerable to a Denial of Service attack through `invite_people` command
An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.
-
Unscored —
An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people sla…
-
Unscored —
An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions.
-
Unscored —
An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than …
-
Unscored —
An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permis…
-
Unscored —
An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file.
-
Unscored —
An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin…
-
Unscored —
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a j…
-
Medium 6.5
Improper Input Validation in strapi
Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to u…
-
Unscored —
An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA.
-
Unscored —
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a den…
-
Unscored —
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not…
-
Unscored —
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, t…
-
Unscored —
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sens…
-
Unscored —
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, b…
-
Unscored —
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proc…
-
Medium 6.1
Dolibarr reflected cross-site scripting (XSS) vulnerability
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
-
Medium 5.4
IBM DOORS Next Generation (DNG/RRC) 6.0.2, 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerab…
-
Medium 5.4
IBM DOORS Next Generation (DNG/RRC) 6.0.2, 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerab…
-
Medium 5.4
IBM DOORS Next Generation (DNG/RRC) 6.0.2, 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerab…
-
Unscored —
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sens…
-
Unscored —
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sens…
-
Unscored —
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.
-
Unscored —
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catast…
-
Unscored —
An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edite…
-
Unscored —
An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Upd…
-
Unscored —
An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated.
-
Unscored —
An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via…
-
Unscored —
An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address …
-
Unscored —
An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows C…
-
Unscored —
In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that …