2020

An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control (for direct-mess

An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slas

An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name w

An issue was discovered in Mattermost Server before 5.2.2, 5.1.2, and 4.10.4. It allows remote attackers to cause a deni

An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing.

An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication creden

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A Syst

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A Syst

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denia

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the

IBM DOORS Next Generation (DNG/RRC) 6.0.2, 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerabi

IBM DOORS Next Generation (DNG/RRC) 6.0.2, 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerabi

IBM DOORS Next Generation (DNG/RRC) 6.0.2, 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerabi

In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that l

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensi

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensi

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.

An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastr

An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited

An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Upda

An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated.

An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via

An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address i

An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CS

An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermo

An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted.

An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands.

An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a craf

An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cau

An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.

An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consum

An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown r

An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.

An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sen

An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (cli

An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that ha

An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information

An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video

An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAu

An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a

An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel

An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the upd

An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-contr

An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, a

An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application

An issue was discovered in Mattermost Server before 5.21.0. Socket read operations are not appropriately restricted, whi

An issue was discovered in Mattermost Server before 5.21.0. mmctl allows directory traversal via HTTP, aka MMSA-2020-001

An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local St

An issue was discovered in Mattermost Server before 5.22.0. The markdown renderer allows attackers to cause a denial of