|
209311
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002.
|
CWE-20
Improper Input Validation
|
CVE-2020-14459
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209312
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004.
|
NVD-CWE-noinfo
|
CVE-2020-14458
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209313
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012.
|
NVD-CWE-noinfo
|
CVE-2020-14457
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209314
|
7.3 |
HIGH
Network
|
mattermost
|
mattermost_desktop
|
An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006.
|
CWE-346
Origin Validation Error
|
CVE-2020-14456
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209315
|
6.5 |
MEDIUM
Network
|
mattermost
|
mattermost_desktop
|
An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007.
|
CWE-287
Improper Authentication
|
CVE-2020-14455
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209316
|
6.1 |
MEDIUM
Network
|
mattermost
|
mattermost_desktop
|
An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008.
|
CWE-601
Open Redirect
|
CVE-2020-14454
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209317
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, which allows attackers to cause a denial of service, aka MMSA-2020-0005.
|
CWE-345
Insufficient Verification of Data Authenticity
|
CVE-2020-14453
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209318
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-0014.
|
CWE-22
Path Traversal
|
CVE-2020-14452
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209319
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_mobile
|
An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013.
|
CWE-459
Incomplete Cleanup
|
CVE-2020-14451
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
209320
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of service (client-side), aka MMSA-2020-0017.
|
NVD-CWE-noinfo
|
CVE-2020-14450
|
2024-11-21 14:03 |
2020-06-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|