Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
153 results · page 2 of 4
Jun 19, 2020An issue was discovered in Mattermost Server before 3.9.0 when SAML is used.CVE-2017-18909 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18904 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2.CVE-2017-18903 · Other software · Mattermost · reported by MITREHigh 8.8
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.CVE-2017-18902 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.CVE-2017-18901 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3.CVE-2017-18900 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18899 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18898 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider.CVE-2017-18897 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18896 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18895 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider.CVE-2017-18894 · Other software · Mattermost · reported by MITREHigh 8.1
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18893 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18892 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5.CVE-2017-18891 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows Phishing because an error page can have a link.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18890 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows an attacker to create a button that, when pressed by a user, launches an API request.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18889 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18888 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18887 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18886 · Other software · Mattermost · reported by MITREHigh 8.8
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18885 · Other software · Mattermost · reported by MITRECritical 9.8
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18884 · Other software · Mattermost · reported by MITREHigh 8.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider.CVE-2017-18883 · Other software · Mattermost · reported by MITRECritical 9.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18882 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18881 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18880 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the title_link field of a Slack attachment.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18879 · Other software · Mattermost · reported by MITREMedium 6.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18878 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used.CVE-2017-18874 · Other software · Mattermost · reported by MITREMedium 6.5
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2.CVE-2018-21264 · Other software · Mattermost · reported by MITREHigh 8.8
An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.1.CVE-2018-21256 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 5.1. It allows attackers to bypass intended access restrictions (for group-message channel creation) via the Group message slash command.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3.CVE-2018-21252 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 5.2, 5.1.1, 5.0.3, and 4.10.3. Attackers could use multiple e-mail addresses to bypass a domain-based policy for signups.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2.CVE-2017-18873 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3.CVE-2017-18872 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.7.CVE-2019-20890 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5.CVE-2019-20889 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5.CVE-2019-20888 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It allows attackers to cause a denial of service (memory consumption) via an outgoing webhook or a slash command integration.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6.CVE-2019-20887 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can receive intra-team posts.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.8.0.CVE-2019-20886 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.8.0.CVE-2019-20885 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 5.8.0. It does not always generate a robots.txt file.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.8.0.CVE-2019-20884 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 5.8.0. It allows attackers to partially attach a file to more than one post.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only.CVE-2019-20883 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.8.0.CVE-2019-20882 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.8.0.CVE-2019-20881 · Other software · Mattermost · reported by MITREHigh 7.3
An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7.CVE-2019-20880 · Other software · Mattermost · reported by MITREHigh 7.5
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. It allows attackers to cause a denial of service (memory consumption) via OpenGraph.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7.CVE-2019-20879 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8.CVE-2019-20878 · Other software · Mattermost · reported by MITREMedium 4.3
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8.CVE-2019-20877 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information about whether someone has 2FA enabled.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8.CVE-2019-20876 · Other software · Mattermost · reported by MITREMedium 5.4
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jun 19, 2020An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8.CVE-2019-20875 · Other software · Mattermost · reported by MITREMedium 5.3
An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed.
- Product
- Mattermost Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.