deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-8164
Published: 2020-06-19
Description: A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00089.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00093.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00107.html
CVE: CVE-2020-8184
Published: 2020-06-19
Description: A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.
CVSS Score: 7.5 (HIGH)
CWE: CWE-784, CWE-20
References: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak; https://hackerone.com/reports/895727; https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
CVE: CVE-2017-18872
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18873
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2018-21252
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2018-21256
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channel creation) via the Group message slash command.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2018-21264
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-13277
Published: 2020-06-19
Description: An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13277.json; https://gitlab.com/gitlab-org/gitlab/-/issues/220972; https://hackerone.com/reports/894569
CVE: CVE-2020-3972
Published: 2020-06-19
Description: VMware Tools for macOS (11.x.x and prior before 11.1.1) contains a denial-of-service vulnerability in the Host-Guest File System (HGFS) implementation. Successful exploitation of this issue may allow attackers with non-admin privileges on guest macOS virtual machines to create a denial-of-service condition on their own VMs.
CVSS Score: 3.3 (LOW)
References: https://www.vmware.com/security/advisories/VMSA-2020-0014.html; https://www.vmware.com/security/advisories/VMSA-2020-0014.html
CVE: CVE-2020-8165
Published: 2020-06-19
Description: A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html; https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c
CVE: CVE-2020-8167
Published: 2020-06-19
Description: A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://groups.google.com/g/rubyonrails-security/c/x9DixQDG9a0; https://hackerone.com/reports/189878; https://www.debian.org/security/2020/dsa-4766
CVE: CVE-2017-18874
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18878
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18879
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18880
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the title_link field of a Slack attachment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18881
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18882
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18883
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-331
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18884
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
CVSS Score: 8.1 (HIGH)
CWE: CWE-269
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18885
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18886
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18887
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18888
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18889
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18890
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18891
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18892
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-116
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18893
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18894
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover.
CVSS Score: 8.1 (HIGH)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18895
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18896
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18897
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18898
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18899
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-770
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18900
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18901
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18902
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18903
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18904
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18909
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18910
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18911
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-295
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18912
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-14929
Published: 2020-06-19
Description: Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.
CVSS Score: 7.5 (HIGH)
References: http://mailman13.u.washington.edu/pipermail/alpine-info/2020-June/008989.html; https://lists.debian.org/debian-lts-announce/2020/06/msg00025.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFXQGKZZMP3VSTLZVO5Z7Z6USYIW37A6/
CVE: CVE-2020-9495
Published: 2020-06-19
Description: Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: http://archiva.apache.org/security.html#CVE-2020-9495; http://www.openwall.com/lists/oss-security/2020/06/19/1; https://lists.apache.org/thread.html/r576eaabe3f772c045ec832a[PII_REDACTED]a2ce3f188f59450dd8f9b6d%40%3Cannounce.apache.org%3E
CVE: CVE-2015-9548
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11062
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11063
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11064
Published: 2020-06-19
Description: An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11065
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11066
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11067
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11068
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11069
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11070
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11071
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11072
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11073
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11074
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11075
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11076
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11077
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
CVSS Score: 2.7 (LOW)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11078
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11079
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11080
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11081
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11082
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11083
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2016-11084
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-352
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/