Page 8 of 41 results (0.011 seconds)

CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0

Mattermost fails to properly check the permissions when executing commands allowing a member with no permissions to post a message in a channel to actually post it by executing channel commands. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

Mattermost fails to verify if the requestor is a sysadmin or not, before allowing `install` requests to the Apps allowing a regular user send install requests to the Apps. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •

CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps. • https://mattermost.com/security-updates • CWE-862: Missing Authorization •

CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0

Mattermost fails to normalize UTF confusable characters when determining if a preview should be generated for a hyperlink, allowing an attacker to trigger link preview on a disallowed domain using a specially crafted link. • https://mattermost.com/security-updates • CWE-20: Improper Input Validation •

CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0

Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. • https://mattermost.com/security-updates • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-532: Insertion of Sensitive Information into Log File •