rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-20804 
Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-21T21:51:03.000Z
CVE-2019-20805 
p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-01T13:50:27.000Z
CVE-2019-20806 
An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T12:00:06.000Z
CVE-2019-20807 
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T13:05:50.000Z
CVE-2019-20808 
In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T00:26:39.000Z
CVE-2019-20809 
The price oracle in PriceOracle.sol in Compound Finance Compound Price Oracle 1.0 through 2.0 allows a price poster to set an invalid asset price via the setPrice function, and consequently violate the intended limits on price swings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T16:54:01.000Z
CVE-2019-20810 
go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T23:14:11.000Z
CVE-2019-20811 
An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T02:44:12.000Z
CVE-2019-20812 
An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-03T02:43:58.000Z
CVE-2019-20813 
An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:37:42.000Z
CVE-2019-20814 
An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows memory consumption because data is created for each page of an application level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:38:05.000Z
CVE-2019-20815 
An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows stack consumption via nested function calls for XML parsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:38:41.000Z
CVE-2019-20816 
An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference during the parsing of file data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:40:44.000Z
CVE-2019-20817 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:44:43.000Z
CVE-2019-20818 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows memory consumption because data is created for each page of an application level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:47:25.000Z
CVE-2019-20819 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows stack consumption via nested function calls for XML parsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:47:53.000Z
CVE-2019-20820 
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference during the parsing of file data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:48:15.000Z
CVE-2019-20821 
An issue was discovered in Foxit PhantomPDF Mac before 3.4. It has a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:48:35.000Z
CVE-2019-20822 
An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.7.0.29430. It has an out-of-bounds write via incorrect image data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T15:49:19.000Z
CVE-2019-20823 
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T17:00:09.000Z
CVE-2019-20824 
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:59:35.000Z
CVE-2019-20825 
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has an out-of-bounds write when Internet Explorer is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:58:37.000Z
CVE-2019-20826 
An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It has a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:58:01.000Z
CVE-2019-20827 
An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It allows stack consumption because of interaction between ICC-Based color space and Alternate color space.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:55:27.000Z
CVE-2019-20828 
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:54:38.000Z
CVE-2019-20829 
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:53:39.000Z
CVE-2019-20830 
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has an out-of-bounds write when Internet Explorer is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:52:23.000Z
CVE-2019-20831 
An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.5.0.20733. It has void data mishandling, causing a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:51:40.000Z
CVE-2019-20832 
An issue was discovered in Foxit PhantomPDF before 8.3.10. It has homograph mishandling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:50:28.000Z
CVE-2019-20833 
An issue was discovered in Foxit PhantomPDF before 8.3.10. It has mishandling of cloud credentials, as demonstrated by Google Drive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:49:30.000Z
CVE-2019-20834 
An issue was discovered in Foxit PhantomPDF before 8.3.10. It allows signature validation bypass via a modified file or a file with non-standard signatures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:47:07.000Z
CVE-2019-20835 
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has homograph mishandling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:44:26.000Z
CVE-2019-20836 
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has mishandling of cloud credentials, as demonstrated by Google Drive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:43:42.000Z
CVE-2019-20837 
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation bypass via a modified file or a file with non-standard signatures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-04T16:43:09.000Z
CVE-2019-20838 
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T16:50:48.000Z
CVE-2019-20839 
libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:11:26.000Z
CVE-2019-20840 
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T15:11:10.000Z
CVE-2019-20841 
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:17:36.000Z
CVE-2019-20842 
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:18:27.000Z
CVE-2019-20843 
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:25:29.000Z
CVE-2019-20844 
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:26:49.000Z
CVE-2019-20845 
An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:27:42.000Z
CVE-2019-20846 
An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:29:06.000Z
CVE-2019-20847 
An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:31:36.000Z
CVE-2019-20848 
An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:32:41.000Z
CVE-2019-20849 
An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:33:56.000Z
CVE-2019-20850 
An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:34:58.000Z
CVE-2019-20851 
An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:02:54.000Z
CVE-2019-20852 
An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message content).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:04:14.000Z
CVE-2019-20853 
An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execution problem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:04:55.000Z
CVE-2019-20854 
An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:05:45.000Z
CVE-2019-20855 
An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment migration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:06:36.000Z
CVE-2019-20856 
An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:07:21.000Z
CVE-2019-20857 
An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backtick characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:10:50.000Z
CVE-2019-20858 
An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL LIKE clause to an APIv4 endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:11:43.000Z
CVE-2019-20859 
An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:13:02.000Z
CVE-2019-20860 
An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:14:57.000Z
CVE-2019-20861 
An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:16:54.000Z
CVE-2019-20862 
An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:17:46.000Z
CVE-2019-20863 
An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:18:41.000Z
CVE-2019-20864 
An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitHub account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:19:22.000Z
CVE-2019-20865 
An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:12:28.000Z
CVE-2019-20866 
An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:13:15.000Z
CVE-2019-20867 
An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:18:25.000Z
CVE-2019-20868 
An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:19:47.000Z
CVE-2019-20869 
An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:21:12.000Z
CVE-2019-20870 
An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:21:54.000Z
CVE-2019-20871 
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:22:39.000Z
CVE-2019-20872 
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:23:27.000Z
CVE-2019-20873 
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:24:13.000Z
CVE-2019-20874 
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T15:42:50.000Z
CVE-2019-20875 
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:22:05.000Z
CVE-2019-20876 
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:22:57.000Z
CVE-2019-20877 
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:28:20.000Z
CVE-2019-20878 
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:29:00.000Z
CVE-2019-20879 
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:29:00.000Z
CVE-2019-20880 
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via OpenGraph.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:29:00.000Z
CVE-2019-20881 
An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:29:01.000Z
CVE-2019-20882 
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:39:23.000Z
CVE-2019-20883 
An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:39:30.000Z
CVE-2019-20884 
An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:42:05.000Z
CVE-2019-20885 
An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:39:33.000Z
CVE-2019-20886 
An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:45:44.000Z
CVE-2019-20887 
An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can receive intra-team posts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:39:39.000Z
CVE-2019-20888 
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory consumption) via an outgoing webhook or a slash command integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:46:39.000Z
CVE-2019-20889 
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:47:07.000Z
CVE-2019-20890 
An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:44:59.000Z
CVE-2019-20891 
WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T20:35:57.000Z