stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2019-20786 (severity: CRITICAL, weakness: CWE-287)
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.
CVE-2019-20787 (severity: CRITICAL, weakness: CWE-190)
Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size.
CVE-2019-20788 (severity: CRITICAL, weakness: CWE-190)
libvncclient/cursor.c in LibVNCServer through 0.9.12 has a HandleCursorShape integer overflow and heap-based buffer overflow via a large height or width value. NOTE: this may overlap CVE-2019-15690.
CVE-2019-20789 (severity: MEDIUM, weakness: CWE-79)
Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.
CVE-2019-2079 (severity: MEDIUM, weakness: CWE-125)
In libxaac, there is a possible out of bounds read due to a missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115509210
CVE-2019-20790 (severity: CRITICAL, weakness: CWE-290)
OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field.
CVE-2019-20791 (severity: CRITICAL, weakness: CWE-787)
OpenThread before 2019-12-13 has a stack-based buffer overflow in MeshCoP::Commissioner::GeneratePskc.
CVE-2019-20792 (severity: MEDIUM, weakness: CWE-415)
OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.
CVE-2019-20794 (severity: MEDIUM, weakness: CWE-772)
An issue was discovered in the Linux kernel 4.18 through 5.6.11 when unprivileged user namespaces are allowed. A user can create their own PID namespace, and mount a FUSE filesystem. Upon interaction with this FUSE filesystem, if the userspace component is terminated via a kill of the PID namespace's pid 1, it will result in a hung task, and resources being permanently locked up until system reboot. This can result in resource exhaustion.
CVE-2019-20795 (severity: MEDIUM, weakness: CWE-416)
iproute2 before 5.1.0 has a use-after-free in get_netnsid_from_name in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors (such as C library configuration) may block exploitability.
CVE-2019-20797 (severity: HIGH, weakness: CWE-787)
An issue was discovered in e6y prboom-plus 2.5.1.5. There is a buffer overflow in client and server code responsible for handling received UDP packets, as demonstrated by I_SendPacket or I_SendPacketTo in i_network.c.
CVE-2019-20798 (severity: HIGH, weakness: CWE-79)
An XSS issue was discovered in handler_server_info.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and execute arbitrary commands.
CVE-2019-20799 (severity: HIGH, weakness: CWE-787)
In Cherokee through 1.2.104, multiple memory corruption errors may be used by a remote attacker to destabilize the work of a server.
CVE-2019-2080 (severity: HIGH, weakness: CWE-787)
In libxaac, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118619159
CVE-2019-20800 (severity: CRITICAL, weakness: CWE-787)
In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in handler_cgi.c by sending many request headers, as demonstrated by a GET request with many "Host: 127.0.0.1" headers.
CVE-2019-20801 (severity: MEDIUM, weakness: CWE-862)
An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server allows for cross-origin requests from any domain, and the WebSocket server lacks authorization control. Any web site can execute JavaScript code (that accesses a user's data) via cross-origin requests.
CVE-2019-20802 (severity: MEDIUM, weakness: CWE-79)
An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server improperly displays directory names, leading to Stored XSS, which may be used to steal a user's data. This requires user interaction because there is no known direct way for an attacker to create a crafted directory name on a victim's device. However, a crafted directory name can occur if a victim extracts a ZIP archive that was provided by an attacker.
CVE-2019-20803 (severity: MEDIUM, weakness: CWE-79)
Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter, which is mishandled for g_preview_theme.
CVE-2019-20804 (severity: HIGH, weakness: CWE-352)
Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI, leading to compromise of the admin account.
CVE-2019-20805 (severity: MEDIUM, weakness: CWE-190)
p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment.
CVE-2019-20806 (severity: MEDIUM, weakness: CWE-476)
An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75.
CVE-2019-20807 (severity: MEDIUM, weakness: CWE-78)
In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua).
CVE-2019-20808 (severity: MEDIUM, weakness: CWE-125)
In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
CVE-2019-20809 (severity: HIGH, weakness: NVD-CWE-Other)
The price oracle in PriceOracle.sol in Compound Finance Compound Price Oracle 1.0 through 2.0 allows a price poster to set an invalid asset price via the setPrice function, and consequently violate the intended limits on price swings.
CVE-2019-2081 (severity: HIGH, weakness: CWE-787)
In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-116473261
CVE-2019-20810 (severity: MEDIUM, weakness: CWE-401)
go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.
CVE-2019-20811 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.
CVE-2019-20812 (severity: MEDIUM, weakness: CWE-400)
An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067.
CVE-2019-20813 (severity: HIGH, weakness: CWE-476)
An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference.
CVE-2019-20814 (severity: HIGH, weakness: CWE-770)
An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows memory consumption because data is created for each page of an application level.
CVE-2019-20815 (severity: HIGH, weakness: CWE-674)
An issue was discovered in Foxit PhantomPDF before 8.3.12. It allows stack consumption via nested function calls for XML parsing.
CVE-2019-20816 (severity: HIGH, weakness: CWE-476)
An issue was discovered in Foxit PhantomPDF before 8.3.12. It has a NULL pointer dereference during the parsing of file data.
CVE-2019-20817 (severity: HIGH, weakness: CWE-476)
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference.
CVE-2019-20818 (severity: HIGH, weakness: CWE-770)
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows memory consumption because data is created for each page of an application level.
CVE-2019-20819 (severity: HIGH, weakness: CWE-674)
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It allows stack consumption via nested function calls for XML parsing.
CVE-2019-2082 (severity: HIGH, weakness: CWE-787)
In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117495103
CVE-2019-20820 (severity: HIGH, weakness: CWE-476)
An issue was discovered in Foxit Reader and PhantomPDF before 9.7. It has a NULL pointer dereference during the parsing of file data.
CVE-2019-20821 (severity: HIGH, weakness: CWE-476)
An issue was discovered in Foxit PhantomPDF Mac before 3.4. It has a NULL pointer dereference.
CVE-2019-20822 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.7.0.29430. It has an out-of-bounds write via incorrect image data.
CVE-2019-20823 (severity: HIGH, weakness: CWE-120)
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs.
CVE-2019-20824 (severity: HIGH, weakness: CWE-476)
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.
CVE-2019-20825 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered in Foxit PhantomPDF before 8.3.11. It has an out-of-bounds write when Internet Explorer is used.
CVE-2019-20826 (severity: HIGH, weakness: CWE-476)
An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It has a NULL pointer dereference.
CVE-2019-20827 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered in Foxit PhantomPDF Mac 3.3 and Foxit Reader for Mac before 3.3. It allows stack consumption because of interaction between ICC-Based color space and Alternate color space.
CVE-2019-20828 (severity: HIGH, weakness: CWE-120)
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a buffer overflow because a looping correction does not occur after JavaScript updates Field APs.
CVE-2019-20829 (severity: HIGH, weakness: CWE-476)
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has a NULL pointer dereference via FXSYS_wcslen in an Epub file.
CVE-2019-2083 (severity: HIGH, weakness: CWE-787)
In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117495362
CVE-2019-20830 (severity: CRITICAL, weakness: CWE-787)
An issue was discovered in Foxit Reader and PhantomPDF before 9.6. It has an out-of-bounds write when Internet Explorer is used.
CVE-2019-20831 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in the 3D Plugin Beta for Foxit Reader and PhantomPDF before 9.5.0.20733. It has void data mishandling, causing a crash.
CVE-2019-20832 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Foxit PhantomPDF before 8.3.10. It has homograph mishandling.
CVE-2019-20833 (severity: HIGH, weakness: CWE-287)
An issue was discovered in Foxit PhantomPDF before 8.3.10. It has mishandling of cloud credentials, as demonstrated by Google Drive.
CVE-2019-20834 (severity: HIGH, weakness: CWE-347)
An issue was discovered in Foxit PhantomPDF before 8.3.10. It allows signature validation bypass via a modified file or a file with non-standard signatures.
CVE-2019-20835 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has homograph mishandling.
CVE-2019-20836 (severity: HIGH, weakness: CWE-200)
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has mishandling of cloud credentials, as demonstrated by Google Drive.
CVE-2019-20837 (severity: HIGH, weakness: CWE-347)
An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It allows signature validation bypass via a modified file or a file with non-standard signatures.
CVE-2019-20838 (severity: HIGH, weakness: CWE-125)
libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.
CVE-2019-20839 (severity: HIGH, weakness: CWE-120)
libvncclient/sockets.c in LibVNCServer before 0.9.13 has a buffer overflow via a long socket filename.
CVE-2019-2084 (severity: HIGH, weakness: CWE-787)
In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117494734
CVE-2019-20840 (severity: HIGH, weakness: CWE-787)
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/ws_decode.c can lead to a crash because of unaligned accesses in hybiReadAndDecode.
CVE-2019-20841 (severity: HIGH, weakness: CWE-352)
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks.
CVE-2019-20842 (severity: HIGH, weakness: CWE-89)
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There is SQL injection by admins via SearchAllChannels.
CVE-2019-20843 (severity: HIGH, weakness: CWE-281)
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files.
CVE-2019-20844 (severity: MEDIUM, weakness: CWE-924)
An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel.
CVE-2019-20845 (severity: HIGH, weakness: CWE-770)
An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import.
CVE-2019-20846 (severity: HIGH, weakness: CWE-281)
An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage.
CVE-2019-20847 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel.
CVE-2019-20848 (severity: HIGH, weakness: CWE-20)
An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies.
CVE-2019-20849 (severity: MEDIUM, weakness: CWE-459)
An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout.
CVE-2019-2085 (severity: HIGH, weakness: CWE-787)
In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117496180
CVE-2019-20850 (severity: MEDIUM, weakness: CWE-459)
An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout.
CVE-2019-20851 (severity: CRITICAL, weakness: CWE-22)
An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device.
CVE-2019-20852 (severity: HIGH, weakness: CWE-532)
An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message content).
CVE-2019-20853 (severity: CRITICAL, weakness: CWE-668)
An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execution problem.
CVE-2019-20854 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX message.
CVE-2019-20855 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment migration.
CVE-2019-20856 (severity: CRITICAL, weakness: CWE-427)
An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.
CVE-2019-20857 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backtick characters.
CVE-2019-20858 (severity: HIGH, weakness: CWE-400)
An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL LIKE clause to an APIv4 endpoint.
CVE-2019-20859 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.
CVE-2019-2086 (severity: HIGH, weakness: CWE-787)
In libxaac, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-114735603
CVE-2019-20860 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG document.
CVE-2019-20861 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.
CVE-2019-20862 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands.
CVE-2019-20863 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted.
CVE-2019-20864 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person's GitHub account.
CVE-2019-20865 (severity: HIGH, weakness: CWE-352)
An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF.
CVE-2019-20866 (severity: MEDIUM, weakness: CWE-444)
An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP address information was mishandled.
CVE-2019-20867 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post.
CVE-2019-20868 (severity: HIGH, weakness: CWE-20)
An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated.
CVE-2019-20869 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.10.0, 5.9.1, 5.8.2, and 4.10.9. A non-member could change the Update/Patch Channel endpoint for a private channel.
CVE-2019-2087 (severity: HIGH, weakness: CWE-787)
In libxaac, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118149009
CVE-2019-20870 (severity: MEDIUM, weakness: CWE-20)
An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID.
CVE-2019-20871 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking.
CVE-2019-20872 (severity: MEDIUM, weakness: CWE-918)
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. SSRF can attack local services.
CVE-2019-20873 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation.
CVE-2019-20874 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change.
CVE-2019-20875 (severity: MEDIUM, weakness: CWE-287)
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed.
CVE-2019-20876 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy.
CVE-2019-20877 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled.
CVE-2019-20878 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled.
CVE-2019-20879 (severity: MEDIUM, weakness: CWE-287)
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry.
CVE-2019-2088 (severity: MEDIUM, weakness: CWE-125)
In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were not enabled, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-143895055
CVE-2019-20880 (severity: HIGH, weakness: CWE-770)
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via OpenGraph.
CVE-2019-20881 (severity: HIGH, weakness: CWE-307)
An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA.
CVE-2019-20882 (severity: MEDIUM, weakness: CWE-276)
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team.
CVE-2019-20883 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post.
CVE-2019-20884 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post.
CVE-2019-20885 (severity: HIGH, weakness: CWE-862)
An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file.