rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-18829 
Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T16:36:46.000Z
CVE-2017-18830 
Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T16:35:40.000Z
CVE-2017-18831 
Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T16:34:32.000Z
CVE-2017-18832 
Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T16:33:13.000Z
CVE-2017-18833 
Certain NETGEAR devices are affected by reflected XSS. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T16:25:50.000Z
CVE-2017-18834 
Certain NETGEAR devices are affected by reflected XSS. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T16:24:42.000Z
CVE-2017-18835 
Certain NETGEAR devices are affected by reflected XSS. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T16:23:01.000Z
CVE-2017-18836 
Certain NETGEAR devices are affected by denial of service. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T16:05:28.000Z
CVE-2017-18837 
Certain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T16:03:26.000Z
CVE-2017-18838 
Certain NETGEAR devices are affected by privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:58:35.000Z
CVE-2017-18839 
Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:55:24.000Z
CVE-2017-18840 
Certain NETGEAR devices are affected by denial of service. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:53:46.000Z
CVE-2017-18841 
Certain NETGEAR devices are affected by command injection. This affects R6220 before 1.1.0.46, R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, WNDR3700v5 before 1.1.0.46, and D7000 before 1.0.1.50.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:51:08.000Z
CVE-2017-18842 
Certain NETGEAR devices are affected by CSRF. This affects R7300 before 1.0.0.54, R8500 before 1.0.2.94, DGN2200v1 before 1.0.0.55, and D2200D/D2200DW-1FRNAS before 1.0.0.32.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:46:58.000Z
CVE-2017-18843 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, and D7000 before 1.0.1.50.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:44:58.000Z
CVE-2017-18844 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, and D7000 before 1.0.1.50.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:43:02.000Z
CVE-2017-18845 
Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38 and R6800 before 1.1.0.38.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:42:07.000Z
CVE-2017-18846 
Certain NETGEAR devices are affected by a stack-based buffer overflow. This affects R6250 before 1.0.4.12, R6400v2 before 1.0.2.32, R7000P/R6900P before 1.0.0.56, R7900 before 1.0.1.18, R8300 before 1.0.2.100_1.0.82, R8500 before 1.0.2.100_1.0.82, and D8500 before 1.0.3.29.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:40:55.000Z
CVE-2017-18847 
Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects R6400v2 before 1.0.2.32, R7000P/R6900P before 1.0.0.56, R7900 before 1.0.1.18, R8300 before 1.0.2.100_1.0.82, R8500 before 1.0.2.100_1.0.82, and D8500 before 1.0.3.29.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:32:16.000Z
CVE-2017-18848 
Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.0.36, AC1450 before 1.0.0.36, R7300 before 1.0.0.54, and R8500 before 1.0.2.94.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:24:53.000Z
CVE-2017-18849 
Certain NETGEAR devices are affected by command injection. This affects D6220 before 1.0.0.26, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1.0.4.12, R6400 before 1.01.24, R6400v2 before 1.0.2.30, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R6900P before 1.0.0.56, R7000 before 1.0.9.4, R7000P before 1.0.0.56, R7100LG before 1.0.0.32, R7300DST before 1.0.0.54, R7900 before 1.0.1.18, R8000 before 1.0.3.44, R8300 before 1.0.2.100_1.0.82, and R8500 before 1.0.2.100_1.0.82.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:23:22.000Z
CVE-2017-18850 
Certain NETGEAR devices are affected by authentication bypass. This affects D6220 before 1.0.0.26, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1.0.4.12, R6400 before 1.01.24, R6400v2 before 1.0.2.30, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R6900P before 1.0.0.56, R7000 before 1.0.9.4, R7000P before 1.0.0.56, R7100LG before 1.0.0.32, R7300DST before 1.0.0.54, R7900 before 1.0.1.18, R8000 before 1.0.3.44, R8300 before 1.0.2.100_1.0.82, and R8500 before 1.0.2.100_1.0.82.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T13:51:46.000Z
CVE-2017-18851 
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D8500 through 1.0.3.28, R6400 through 1.0.1.22, R6400v2 through 1.0.2.18, R8300 through 1.0.2.94, R8500 through 1.0.2.94, and R6100 through 1.0.1.12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T12:50:43.000Z
CVE-2017-18852 
Certain NETGEAR devices are affected by CSRF and authentication bypass. This affects R7300DST before 1.0.0.54, R8300 before 1.0.2.100_1.0.82, R8500 before 1.0.2.100_1.0.82, and WNDR3400v3 before 1.0.1.14.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T12:42:02.000Z
CVE-2017-18853 
Certain NETGEAR devices are affected by password recovery and file access. This affects D8500 1.0.3.27 and earlier, DGN2200v4 1.0.0.82 and earlier, R6300v2 1.0.4.06 and earlier, R6400 1.0.1.20 and earlier, R6400v2 1.0.2.18 and earlier, R6700 1.0.1.22 and earlier, R6900 1.0.1.20 and earlier, R7000 1.0.7.10 and earlier, R7000P 1.0.0.58 and earlier, R7100LG 1.0.0.28 and earlier, R7300DST 1.0.0.52 and earlier, R7900 1.0.1.12 and earlier, R8000 1.0.3.46 and earlier, R8300 1.0.2.86 and earlier, R8500 1.0.2.86 and earlier, WNDR3400v3 1.0.1.8 and earlier, and WNDR4500v2 1.0.0.62 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:10:31.000Z
CVE-2017-18854 
NETGEAR ReadyNAS 6.6.1 and earlier is affected by command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:13:36.000Z
CVE-2017-18855 
NETGEAR WNR854T devices before 1.5.2 are affected by command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:14:54.000Z
CVE-2017-18856 
NETGEAR ReadyNAS devices before 6.6.1 are affected by command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:43:16.000Z
CVE-2017-18857 
The NETGEAR Insight application before 2.42 for Android and iOS is affected by password mismanagement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:41:28.000Z
CVE-2017-18858 
Certain NETGEAR devices are affected by command execution. This affects M4200-10MG-POE+ 12.0.2.11 and earlier, M4300-28G 12.0.2.11 and earlier, M4300-52G 12.0.2.11 and earlier, M4300-28G-POE+ 12.0.2.11 and earlier, M4300-52G-POE+ 12.0.2.11 and earlier, M4300-8X8F 12.0.2.11 and earlier, M4300-12X12F 12.0.2.11 and earlier, M4300-24X24F 12.0.2.11 and earlier, M4300-24X 12.0.2.11 and earlier, and M4300-48X 12.0.2.11 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:43:19.000Z
CVE-2017-18859 
Certain NETGEAR devices are affected by slowdown/stoppage. This affects C6300 before 2017-05-30, CM400 before 2017-05-30, CM700 before 2017-05-30, and CMD31T before 2017-05-30.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T16:45:50.000Z
CVE-2017-18860 
Certain NETGEAR devices are affected by debugging command execution. This affects FS752TP 5.4.2.19 and earlier, GS108Tv2 5.4.2.29 and earlier, GS110TP 5.4.2.29 and earlier, GS418TPP 6.6.2.6 and earlier, GS510TLP 6.6.2.6 and earlier, GS510TP 5.04.2.27 and earlier, GS510TPP 6.6.2.6 and earlier, GS716Tv2 5.4.2.27 and earlier, GS716Tv3 6.3.1.16 and earlier, GS724Tv3 5.4.2.27 and earlier, GS724Tv4 6.3.1.16 and earlier, GS728TPSB 5.3.0.29 and earlier, GS728TSB 5.3.0.29 and earlier, GS728TXS 6.1.0.35 and earlier, GS748Tv4 5.4.2.27 and earlier, GS748Tv5 6.3.1.16 and earlier, GS752TPSB 5.3.0.29 and earlier, GS752TSB 5.3.0.29 and earlier, GS752TXS 6.1.0.35 and earlier, M4200 12.0.2.10 and earlier, M4300 12.0.2.10 and earlier, M5300 11.0.0.28 and earlier, M6100 11.0.0.28 and earlier, M7100 11.0.0.28 and earlier, S3300 6.6.1.4 and earlier, XS708T 6.6.0.11 and earlier, XS712T 6.1.0.34 and earlier, and XS716T 6.6.0.11 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:38:19.000Z
CVE-2017-18861 
Certain NETGEAR devices are affected by CSRF. This affects ReadyNAS Surveillance 1.4.3-15-x86 and earlier and ReadyNAS Surveillance 1.1.4-5-ARM and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T15:53:13.000Z
CVE-2017-18862 
Certain NETGEAR devices are affected by authentication bypass. This affects JGS516PE before 2017-05-11, JGS524Ev2 before 2017-05-11, JGS524PE before 2017-05-11, GS105Ev2 before 2017-05-11, GS105PE before 2017-05-11, GS108Ev3 before 2017-05-11, GS108PEv3 before 2017-05-11, GS116Ev2 before 2017-05-11, GSS108E before 2017-05-11, GSS116E before 2017-05-11, XS708Ev2 before 2017-05-11, and XS716E before 2017-05-11.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T15:54:25.000Z
CVE-2017-18863 
Certain NETGEAR devices are affected by command execution via a PHP form. This affects WN604 3.3.3 and earlier, WNAP210v2 3.5.20.0 and earlier, WNAP320 3.5.20.0 and earlier, WNDAP350 3.5.20.0 and earlier, WNDAP360 3.5.20.0 and earlier, WNDAP620 2.0.11 and earlier, WNDAP660 3.5.20.0 and earlier, WND930 2.0.11 and earlier, and WAC120 2.0.7 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T15:56:07.000Z
CVE-2017-18864 
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects R6400 before 1.0.1.24, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000 before 1.0.9.4, R7000P before 1.0.0.56, R6900P before 1.0.0.56, R7100LG before 1.0.0.32, R7300 before 1.0.0.54, R7900 before 1.0.1.18, R8300 before 1.0.2.104, and R8500 before 1.0.2.104.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T13:48:35.000Z
CVE-2017-18865 
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8300 before 1.0.2.104 and R8500 before 1.0.2.104.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T13:48:11.000Z
CVE-2017-18866 
Certain NETGEAR devices are affected by stored XSS. This affects R9000 before 1.0.2.40, R6100 before 1.0.1.1, 6R7500 before 1.0.0.110, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, WNDR4300v2 before 1.0.0.48, and WNR2000v5 before 1.0.0.58.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T13:47:53.000Z
CVE-2017-18867 
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6100 before 1.0.0.55, D7800 before V1.0.1.24, R7100LG before V1.0.0.32, WNDR4300v1 before 1.0.2.90, and WNDR4500v3 before 1.0.0.48.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T13:47:18.000Z
CVE-2017-18868 
Digi XBee 2 devices do not have an effective protection mechanism against remote AT commands, because of issues related to the network stack upon which the ZigBee protocol is built.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-21T19:13:43.000Z
CVE-2017-18869 
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T14:33:51.000Z
CVE-2017-18870 
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:47:11.000Z
CVE-2017-18871 
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:51:40.000Z
CVE-2017-18872 
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T17:44:11.000Z
CVE-2017-18873 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T17:44:12.000Z
CVE-2017-18874 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:07:29.000Z
CVE-2017-18875 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:47:13.000Z
CVE-2017-18876 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:50:02.000Z
CVE-2017-18877 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:50:36.000Z
CVE-2017-18878 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:20.000Z
CVE-2017-18879 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:42.000Z
CVE-2017-18880 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the title_link field of a Slack attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:42:54.000Z
CVE-2017-18881 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:44.000Z
CVE-2017-18882 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:46.000Z
CVE-2017-18883 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:47.000Z
CVE-2017-18884 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:48.000Z
CVE-2017-18885 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:10:29.000Z
CVE-2017-18886 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:43:16.000Z
CVE-2017-18887 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:10:59.000Z
CVE-2017-18888 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:10:58.000Z
CVE-2017-18889 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:54.000Z
CVE-2017-18890 
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:53.000Z
CVE-2017-18891 
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:50.000Z
CVE-2017-18892 
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:08:51.000Z
CVE-2017-18893 
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:10:57.000Z