rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-11000 
The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:32:57.000Z
CVE-2016-11001 
The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:35:09.000Z
CVE-2016-11002 
The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:39:03.000Z
CVE-2016-11003 
The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:38:21.000Z
CVE-2016-11004 
The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:39:42.000Z
CVE-2016-11005 
The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:41:18.000Z
CVE-2016-11006 
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:43:10.000Z
CVE-2016-11007 
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:44:13.000Z
CVE-2016-11008 
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:44:47.000Z
CVE-2016-11009 
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:45:30.000Z
CVE-2016-11010 
The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:46:10.000Z
CVE-2016-11011 
The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:47:29.000Z
CVE-2016-11012 
The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:48:38.000Z
CVE-2016-11013 
The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-20T14:49:50.000Z
CVE-2016-11014 
NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-16T00:26:23.000Z
CVE-2016-11015 
NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-16T00:25:58.000Z
CVE-2016-11016 
NETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-16T00:25:37.000Z
CVE-2016-11017 
The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell metacharacters in the username parameter (a failed login attempt returns the command-injection output to a limited login failure field). This is fixed in 16.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-06T16:30:56.000Z
CVE-2016-11018 
An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone to unauthenticated SQL injection. The affected file is gallery-images.php. The affected function is huge_it_image_gallery_ajax_callback().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-21T18:26:25.000Z
CVE-2016-11020 
Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-24T17:04:35.000Z
CVE-2016-11021 
setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T00:55:19.000Z
CVE-2016-11022 
NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges via shell metacharacters in the reqMethod parameter to login_handler.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-23T14:17:51.000Z
CVE-2016-11023 
odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-30T19:41:55.000Z
CVE-2016-11024 
odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-30T19:41:46.000Z
CVE-2016-11025 
An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a memcpy heap-based buffer overflow in the OTP service. The Samsung ID is SVE-2016-7114 (December 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:50:43.000Z
CVE-2016-11026 
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. BootReceiver allows attackers to trigger a system crash because of incorrect exception handling. The Samsung ID is SVE-2016-7118 (December 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:49:38.000Z
CVE-2016-11027 
An issue was discovered on Samsung mobile devices with M(6.0) software. In the Shade Locked state, a physically proximate attacker can read notifications on the lock screen. The Samsung ID is SVE-2016-7132 (December 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:48:10.000Z
CVE-2016-11028 
An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a stack-based buffer overflow in the OTP TrustZone trustlet. The Samsung IDs are SVE-2016-7173 and SVE-2016-7174 (December 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:46:58.000Z
CVE-2016-11029 
An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software. Attackers can read the password of the Mobile Hotspot in the log because of an unprotected intent. The Samsung ID is SVE-2016-7301 (December 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:45:49.000Z
CVE-2016-11030 
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (with Hrm sensor support) software. The sysfs of the MAX86902 sensor driver does not prevent concurrent access, leading to a race condition and resultant heap-based buffer overflow. The Samsung ID is SVE-2016-7341 (December 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:44:36.000Z
CVE-2016-11031 
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. AntService allows a system_server crash and reboot. The Samsung ID is SVE-2016-7044 (November 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:42:43.000Z
CVE-2016-11032 
An issue was discovered on Samsung mobile devices with M(6.0) software. An attacker can disable all Sound functionality by broadcasting an unprotected intent. The Samsung IDs are SVE-2016-7179 and SVE-2016-7182 (November 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:38:52.000Z
CVE-2016-11033 
An issue was discovered on Samsung mobile devices with M(6.0) software. There is a heap-based buffer overflow in tlc_server. The Samsung IDs are SVE-2016-7220 and SVE-2016-7225 (November 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:30:10.000Z
CVE-2016-11034 
An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. The decode function in Qjpeg in Qt 5.7 allows attackers to trigger a system crash via a malformed image. The Samsung ID is SVE-2016-6560 (October 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:26:42.000Z
CVE-2016-11035 
An issue was discovered on Samsung mobile devices with software through 2016-05-27 (Exynos AP chipsets). A local graphics user can cause a Kernel Crash via the fb0(DECON) frame buffer interface. The Samsung ID is SVE-2016-7011 (October 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:24:58.000Z
CVE-2016-11036 
An issue was discovered on Samsung mobile devices with M(6.0) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-6008 (August 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:23:11.000Z
CVE-2016-11038 
An issue was discovered on Samsung mobile devices with software through 2016-04-05 (incorporating the Samsung Professional Audio SDK). The Jack audio service doesn't implement access control for shared memory, leading to arbitrary code execution or privilege escalation. The Samsung ID is SVE-2016-5953 (July 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:17:05.000Z
CVE-2016-11039 
An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (AP + CP MDM9x35, or Qualcomm Onechip) software. There is a NULL pointer dereference issue in the IPC socket code. The Samsung ID is SVE-2016-5980 (July 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:09:06.000Z
CVE-2016-11040 
An issue was discovered on Samsung mobile devices with L(5.0/5.1) (with USB OTG MyFile2014_L_ESS support) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2015-5068 (June 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T13:07:08.000Z
CVE-2016-11041 
An issue was discovered on Samsung mobile devices with KK(4.4) software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID is SVE-2015-5301 (June 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:55:21.000Z
CVE-2016-11042 
An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. There is a SIM Lock bypass. The Samsung ID is SVE-2016-5381 (June 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:54:19.000Z
CVE-2016-11043 
An issue was discovered on Samsung mobile devices with M(6.0) software. The S/MIME implementation in EAS uses DES (where 3DES is intended). The Samsung ID is SVE-2016-5871 (June 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:53:17.000Z
CVE-2016-11044 
An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (with Fingerprint support) software. The check of an application's signature can be bypassed during installation. The Samsung ID is SVE-2016-5923 (June 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:51:58.000Z
CVE-2016-11045 
An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. The Gallery library allow memory corruption via a malformed image. The Samsung ID is SVE-2016-5317 (May 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:50:03.000Z
CVE-2016-11046 
An issue was discovered on Samsung mobile devices with JBP(4.3), KK(4.4), and L(5.0/5.1) software. Because of a misused whitelist, attackers can reach the radio layer (aka RIL or RILD) to place calls or send SMS messages. The Samsung ID is SVE-2016-5733 (May 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:48:24.000Z
CVE-2016-11047 
An issue was discovered on Samsung mobile devices with JBP(4.2) and KK(4.4) (Marvell chipsets) software. The ACIPC-MSOCKET driver allows local privilege escalation via a stack-based buffer overflow. The Samsung ID is SVE-2016-5393 (April 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:46:51.000Z
CVE-2016-11048 
An issue was discovered on Samsung mobile devices with L(5.0/5.1) (Spreadtrum or Marvell chipsets) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-5421 (March 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:45:19.000Z
CVE-2016-11049 
An issue was discovered on Samsung mobile devices with software through 2016-01-16 (Shannon333/308/310 chipsets). The IMEI may be retrieved and modified because of an error in managing key information. The Samsung ID is SVE-2016-5435 (March 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:44:05.000Z
CVE-2016-11050 
An issue was discovered on Samsung mobile devices with S3(KK), Note2(KK), S4(L), Note3(L), and S5(L) software. An attacker can rewrite the IMEI by flashing crafted firmware. The Samsung ID is SVE-2016-5562 (March 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:41:16.000Z
CVE-2016-11052 
An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. je_free in libQjpeg.so in Qjpeg in Qt 5.5 allows memory corruption via a malformed JPEG file. The Samsung ID is SVE-2015-5110 (January 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:34:22.000Z
CVE-2016-11053 
An issue was discovered on Samsung mobile devices with software through 2015-11-11 (supporting FRP/RL). There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2015-5131 (January 2016).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-07T12:32:19.000Z
CVE-2016-11054 
NETGEAR DGN2200v4 devices before 2017-01-06 are affected by command execution and an FTP insecure root directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T15:57:29.000Z
CVE-2016-11055 
Certain NETGEAR devices are affected by CSRF. This affects CM400 before 2017-01-11, CM600 before 2017-01-11, D1500 before 2017-01-11, D500 before 2017-01-11, DST6501 before 2017-01-11, JNR1010v1 before 2017-01-11, JWNR2000Tv3 before 2017-01-11, JWNR2010v3 before 2017-01-11, PLW1000 before 2017-01-11, PLW1010 before 2017-01-11, WNR500 before 2017-01-11, WNR612v3 before 2017-01-11, N450 before 2017-01-11, and CG3000Dv2 before 2017-01-11.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T15:59:19.000Z
CVE-2016-11056 
Certain NETGEAR devices are affected by anonymous root access. This affects ReadyNAS Surveillance 1.1.1-3-armel and earlier and ReadyNAS Surveillance 1.4.1-3-amd64 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:00:35.000Z
CVE-2016-11057 
Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 2017-01-06, JWNR2000v5 before 2017-01-06, WNR2020 before 2017-01-06, JWNR2010v5 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2020v2 before 2017-01-06, R6220 before 2017-01-06, and WNDR3700v5 before 2017-01-06.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:11:14.000Z
CVE-2016-11058 
The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:12:43.000Z
CVE-2016-11059 
Certain NETGEAR devices are affected by password exposure. This affects AC1450 before 2017-01-06, C6300 before 2017-01-06, D500 before 2017-01-06, D1500 before 2017-01-06, D3600 before 2017-01-06, D6000 before 2017-01-06, D6100 before 2017-01-06, D6200 before 2017-01-06, D6200B before 2017-01-06, D6300B before 2017-01-06, D6300 before 2017-01-06, DGN1000v3 before 2017-01-06, DGN2200v1 before 2017-01-06, DGN2200v3 before 2017-01-06, DGN2200V4 before 2017-01-06, DGN2200Bv3 before 2017-01-06, DGN2200Bv4 before 2017-01-06, DGND3700v1 before 2017-01-06, DGND3700v2 before 2017-01-06, DGND3700Bv2 before 2017-01-06, JNR1010v1 before 2017-01-06, JNR1010v2 before 2017-01-06, JNR3300 before 2017-01-06, JR6100 before 2017-01-06, JR6150 before 2017-01-06, JWNR2000v5 before 2017-01-06, R2000 before 2017-01-06, R6050 before 2017-01-06, R6100 before 2017-01-06, R6200 before 2017-01-06, R6200v2 before 2017-01-06, R6220 before 2017-01-06, R6250 before 2017-01-06, R6300 before 2017-01-06, R6300v2 before 2017-01-06, R6700 before 2017-01-06, R7000 before 2017-01-06, R7900 before 2017-01-06, R7500 before 2017-01-06, R8000 before 2017-01-06, WGR614v10 before 2017-01-06, WNR1000v2 before 2017-01-06, WNR1000v3 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2000v3 before 2017-01-06, WNR2000v4 before 2017-01-06, WNR2000v5 before 2017-01-06, WNR2200 before 2017-01-06, WNR2500 before 2017-01-06, WNR3500Lv2 before 2017-01-06, WNDR3400v2 before 2017-01-06, WNDR3400v3 before 2017-01-06, WNDR3700v3 before 2017-01-06, WNDR3700v4 before 2017-01-06, WNDR3700v5 before 2017-01-06, WNDR4300 before 2017-01-06, WNDR4300v2 before 2017-01-06, WNDR4500v1 before 2017-01-06, WNDR4500v2 before 2017-01-06, and WNDR4500v3 before 2017-01-06.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:20:22.000Z
CVE-2016-11060 
Certain NETGEAR devices are affected by insecure renegotiation. This affects SRX5308 before 2017-02-10, FVS336Gv3 before 2017-02-10, FVS318N before 2017-02-10, and FVS318Gv2 before 2017-02-10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:14:48.000Z
CVE-2016-11061 
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T21:23:30.000Z
CVE-2016-11062 
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:21:50.000Z
CVE-2016-11063 
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:22:15.000Z
CVE-2016-11064 
An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:22:33.000Z
CVE-2016-11065 
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:23:02.000Z
CVE-2016-11066 
An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:23:24.000Z
CVE-2016-11067 
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:24:31.000Z
CVE-2016-11068 
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:24:49.000Z
CVE-2016-11069 
An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:25:13.000Z
CVE-2016-11070 
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:25:34.000Z
CVE-2016-11071 
An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:25:54.000Z
CVE-2016-11072 
An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:26:14.000Z
CVE-2016-11073 
An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:26:32.000Z
CVE-2016-11074 
An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:26:52.000Z
CVE-2016-11075 
An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:27:18.000Z
CVE-2016-11076 
An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:27:37.000Z
CVE-2016-11077 
An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:28:01.000Z