rpm package
opensuse/govulncheck-vulndb&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
Vulnerabilities (1,719)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2017-18889 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API. | |
| CVE-2017-18888 | Cri | 9.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts. | |
| CVE-2017-18887 | Med | 5.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members. | |
| CVE-2017-18886 | Hig | 8.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands. | |
| CVE-2017-18885 | Cri | 9.8 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf. | |
| CVE-2017-18884 | Hig | 8.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens. | |
| CVE-2017-18883 | Cri | 9.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data. | |
| CVE-2017-18879 | Med | 6.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment. | |
| CVE-2017-18878 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session. | |
| CVE-2017-18874 | Med | 6.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal. | |
| CVE-2017-18873 | Med | 5.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post. | |
| CVE-2017-18872 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider. | |
| CVE-2018-21258 | Hig | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command. | |
| CVE-2017-18877 | Med | 6.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page. | |
| CVE-2017-18876 | Med | 4.9 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file. | |
| CVE-2017-18875 | Med | 4.9 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files. | |
| CVE-2017-18871 | Hig | 7.5 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name. | |
| CVE-2017-18870 | Med | 4.3 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Jun 19, 2020 | An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case. | |
| CVE-2019-8400 | Med | 6.1 | < 0.0.20260723T184607-160000.1.1 | 0.0.20260723T184607-160000.1.1 | Feb 17, 2019 | ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter. |
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by using a registered OAuth application with personal access tokens.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. Knowledge of a session ID allows revoking another user's session.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can achieve directory traversal.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to cause a denial of service (channel invisibility) via a misformatted post.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can test for the existence of an arbitrary file.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2 when local storage for files is used. A System Admin can create arbitrary files.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, and 4.3.4. It mishandled webhook access control in the EnableOnlyAdminIntegrations case.
- affected < 0.0.20260723T184607-160000.1.1fixed 0.0.20260723T184607-160000.1.1
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
Page 86 of 86