Page 10 of 62 results (0.016 seconds)

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •

CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0

A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •

CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0

A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. Una vulnerabilidad de Denegación de Servicio (DoS) en Mattermost permite que un usuario autenticado bloquee el servidor a través de múltiples mensajes de respuesta automática de gran tamaño. • https://hackerone.com/reports/1680241 https://mattermost.com/security-updates • CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0

The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to fetch a list of all public channels in the team, in spite of not being part of those channels. La función de cuenta de invitado en Mattermost versiones 6.7.0 y anteriores no restringe apropiadamente los permisos, lo que permite a un usuario invitado conseguir una lista de todos los canales públicos del equipo, a pesar de no formar parte de esos canales • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •