Page 7 of 34 results (0.007 seconds)

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •

CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0

Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link. • https://mattermost.com/security-updates • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0

Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0

Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •