|
219281
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated.
|
CWE-20
Improper Input Validation
|
CVE-2019-20868
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219282
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post.
|
NVD-CWE-noinfo
|
CVE-2019-20867
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219283
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled.
|
CWE-444
HTTP Request Smuggling
|
CVE-2019-20866
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219284
|
8.8 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.
|
CWE-352
Origin Validation Error
|
CVE-2019-20865
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219285
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_plugins
|
An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitHub account.
|
NVD-CWE-noinfo
|
CVE-2019-20864
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219286
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted.
|
NVD-CWE-noinfo
|
CVE-2019-20863
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219287
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands.
|
NVD-CWE-noinfo
|
CVE-2019-20862
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219288
|
8.8 |
HIGH
Network
|
mattermost
|
mattermost_desktop
|
An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.
|
NVD-CWE-noinfo
|
CVE-2019-20861
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219289
|
5.5 |
MEDIUM
Local
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG document.
|
NVD-CWE-noinfo
|
CVE-2019-20860
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
219290
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.
|
NVD-CWE-noinfo
|
CVE-2019-20859
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|