|
221431
|
5.5 |
MEDIUM
Local
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2019-20872
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
221432
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking.
|
NVD-CWE-Other
|
CVE-2019-20871
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
221433
|
4.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID.
|
CWE-20
Improper Input Validation
|
CVE-2019-20870
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
221434
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel.
|
NVD-CWE-noinfo
|
CVE-2019-20869
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
221435
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated.
|
CWE-20
Improper Input Validation
|
CVE-2019-20868
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
221436
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post.
|
NVD-CWE-noinfo
|
CVE-2019-20867
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
221437
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled.
|
CWE-444
HTTP Request Smuggling
|
CVE-2019-20866
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
221438
|
8.8 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.
|
CWE-352
Origin Validation Error
|
CVE-2019-20865
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
221439
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_plugins
|
An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitHub account.
|
NVD-CWE-noinfo
|
CVE-2019-20864
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
221440
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted.
|
NVD-CWE-noinfo
|
CVE-2019-20863
|
2024-11-21 13:39 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|