Vulnerabilities > Mattermost > Mattermost > 1.29.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-11-06 | CVE-2023-5967 | Improper Check for Unusual or Exceptional Conditions vulnerability in Mattermost Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin | 4.3 |
| 2023-11-06 | CVE-2023-5968 | Improper Encoding or Escaping of Output vulnerability in Mattermost Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. | 4.9 |
| 2023-11-06 | CVE-2023-5969 | Resource Exhaustion vulnerability in Mattermost Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items. | 5.3 |
| 2023-10-17 | CVE-2023-5522 | Unspecified vulnerability in Mattermost Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojis to a channel and freeze the mobile app of users when viewing that particular channel. | 4.3 |
| 2023-07-17 | CVE-2023-3615 | Improper Certificate Validation vulnerability in Mattermost Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection. | 8.1 |
| 2023-05-12 | CVE-2023-2514 | Information Exposure Through Log Files vulnerability in Mattermost Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. | 7.5 |
| 2023-03-22 | CVE-2023-1562 | Exposure of Resource to Wrong Sphere vulnerability in Mattermost Mattermost fails to check the "Show Full Name" setting when rendering the result for the /plugins/focalboard/api/v2/users API call, allowing an attacker to learn the full name of a board owner. | 4.3 |
| 2023-02-27 | CVE-2023-27263 | Missing Authorization vulnerability in Mattermost A missing permissions check in the /plugins/playbooks/api/v0/runs API in Mattermost allows an attacker to list and view playbooks belonging to a team they are not a member of. | 6.5 |
| 2023-02-27 | CVE-2023-27264 | Missing Authorization vulnerability in Mattermost A missing permissions check in Mattermost Playbooks in Mattermost allows an attacker to modify a playbook via the /plugins/playbooks/api/v0/playbooks/[playbookID] API. | 6.5 |
| 2022-11-23 | CVE-2022-4044 | Allocation of Resources Without Limits or Throttling vulnerability in Mattermost A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. | 6.5 |