CVE Vulnerability

NVD-CWE-noinfo

CVE-2019-20859

by

An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input.

CVE-2019-20860

by

An issue was discovered in Mattermost Server before 5.14.0, 5.13.3, 5.12.6, and 5.9.4. It allows remote attackers to cause a denial of service (application hang) via a crafted SVG document.

CVE-2019-20861

by

An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link.

CVE-2019-20862

by

An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team’s slash commands.

CVE-2019-20863

by

An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted.

CVE-2019-20864

by

An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person’s GitHub account.