Vulnerabilities > Mattermost > Mattermost Server > 7.8.14
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-02 | CVE-2023-48732 | Unspecified vulnerability in Mattermost Server Mattermost fails to scope the WebSocket response around notified users to a each user separately resulting in the WebSocket broadcasting the information about who was notified about a post to everyone else in the channel. | 4.3 |
| 2024-01-02 | CVE-2023-50333 | Unspecified vulnerability in Mattermost Server Mattermost fails to update the permissions of the current session for a user who was just demoted to guest, allowing freshly demoted guests to change group names. | 4.3 |
| 2023-12-29 | CVE-2023-7113 | Cross-site Scripting vulnerability in Mattermost Server Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client. | 6.1 |
| 2023-12-12 | CVE-2023-6727 | Unspecified vulnerability in Mattermost Server Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. | 4.3 |
| 2023-12-12 | CVE-2023-49809 | Resource Exhaustion vulnerability in Mattermost Server Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. | 6.5 |
| 2023-12-12 | CVE-2023-6547 | Unspecified vulnerability in Mattermost Server Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions to a playbook but no permissions to the team the playbook is on to access and modify the playbook. | 5.4 |
| 2023-04-25 | CVE-2023-2281 | Unspecified vulnerability in Mattermost Server When archiving a team, Mattermost fails to sanitize the related Websocket event sent to currently connected clients. | 4.3 |