Go PACKAGE

github.com/mattermost/mattermost-server/v6 v6.7.2

Warn

PkgFire would install this release with a warning.·Checked 5 hours ago·Published 14 June 2022

pkg.go.dev

Why

  • warnVulnerability

    Mattermost allows demoted guests to change group names in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Cross-site Scripting vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost notified all users in the channel when using WebSockets to respond individually in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost viewing archived public channels permissions vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost vulnerable to denial of service via large number of emoji reactions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to check the required permissions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost race condition in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost denial of service through long emoji value in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost leaks details of AD/LDAP groups of a teams in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost post fetching without auditing in compliance export in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows attackers access to posts in channels they are not a member of in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to check the "invite_guest" permission in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to limit the number of role names in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly restrict the access of files attached to posts in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost incorrectly allows access individual posts in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Server doesn't limit the number of user preferences in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to authenticate the source of certain types of post actions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Server Improper Access Control in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Server Improper Access Control in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows a remote actor to permanently delete local data by abusing dangerous error handling in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows remote actor to set arbitrary RemoteId values for synced users in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows remote actor to create/update/delete posts in arbitrary channels in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows a user on a remote to set their remote username prop to an arbitrary string in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost failed to disallow the modification of local users when syncing users in shared channels in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost failed to properly validate synced reactions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows a remote actor to make an arbitrary local channel read-only in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost did not properly restrict channel creation in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows guest user with read access to upload files to a channel in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows team admin user without "Add Team Members" permission to disable invite URL in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows user with systems manager role with read-only access to teams to perform write operations on teams in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows unsolicited invites to expose access to local channels in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't restrict which roles can promote a user as system admin in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Cross-Site Request Forgery vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to strip `embeds` from `metadata` when broadcasting `posted` events in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Server allows user to get private channel names in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Server vulnerable to application crash from attacker-generated large response in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Server Resource Exhaustion in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Race Condition vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Data Amplification vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Improper Validation of Specified Type of Input vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has Improper Check for Unusual or Exceptional Conditions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Incorrect Type Conversion or Cast in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly validate post props in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost webapp crash via a crafted post in github.com/mattermost/mattermost-server

  • warnLikely exploited

    Mattermost allows reading arbitrary files related to importing boards in github.com/mattermost/mattermost-server EPSS puts the chance of exploitation in the next 30 days at 24% (higher than 98% of all scored vulnerabilities). That is a forecast, not an observation, so it raises this finding rather than blocking it.

  • warnVulnerability

    Mattermost fails to restrict channel export of archived channels in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to invalidate all active sessions when converting a user to a bot in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows reading arbitrary files in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Properly Perform Viewer Role Authorization in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Restrict Command Execution in Archived Channels in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fail to prompt for explicit approval before adding a team admin to a private channel in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows members with permission to convert public channels to private and convert private to public in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Restrict Certain Operations on System Admins in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost vulnerable to Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost vulnerable to Observable Timing Discrepancy in github.com/mattermost/mattermost-plugin-msteams

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't restrict domains LLM can request to contact upstream in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Playbooks fails to properly validate the props used by the RetrospectivePost custom post type in github.com/mattermost/mattermost-plugin-playbooks

  • warnVulnerability

    Mattermost Playbooks fails to validate the uniqueness and quantity of task actions in github.com/mattermost/mattermost-plugin-playbooks

  • warnVulnerability

    Mattermost Playbooks fails to properly validate permissions in github.com/mattermost/mattermost-plugin-playbooks

  • warnVulnerability

    Mattermost Fails to Verify User's Permissions When Accessing Groups in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Lockout LDAP Users After Repeated Login Failures in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Validate Team Invite Permissions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Check User Access to `ExperimentalSettings` in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost improperly allows team administrators to modify team invites in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly enforce access control restrictions for System Manager roles in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to clear Google OAuth credentials in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly enforce access controls for guest users in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows authenticated administrator to execute LDAP search filter injection in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows guest users to view information about public teams they are not members of in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows authenticated users to write files to arbitrary locations in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows an unauthorized Guest user access to Playbook in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows unauthorized channel member management through playbook runs in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Missing Authentication for Critical Function in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Validate File Paths in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Lack of Access Control Validation in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Validate Remote Cluster Upload Sessions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Does Not Sanitize the Team Invite ID in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Server SSRF Vulnerability via the Agents Plugin in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Sanitize Path Traversal Sequences in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Fails to Sanitize File Names in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has Potential Server Crash due to Unvalidated Import Data in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Missing Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost makes Use of Weak Hash in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Open Redirect vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Path Traversal vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost boards plugin fails to restrict download access to files in github.com/mattermost/mattermost-plugin-boards

  • warnVulnerability

    Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has an Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has a Missing Authorization vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost

  • warnVulnerability

    Mattermost fails to properly restrict access to archived channel search API in github.com/mattermost/mattermost

  • warnVulnerability

    Mattermost does not enforce MFA on WebSocket connections in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows system administrators to access password hashes and MFA secrets in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows regular users to access archived channel content and files in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows other users to determine when users had read channels via channel member objects in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly validate OAuth state tokens during OpenID Connect authentication in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to sanitize team email addresses in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to to verify the token used during code exchange in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to validate user permissions when deleting comments in Boards in github.com/mattermost/mattermost

  • warnVulnerability

    Mattermost fails to validate user permissions in Boards in github.com/mattermost/mattermost

  • warnVulnerability

    Mattermost GitHub Plugin Bot Identity Validation Bypass Allows Arbitrary GitHub Reaction Injection in github.com/mattermost/mattermost

  • warnVulnerability

    Mattermost has missing redirect URL validation in github.com/mattermost/mattermost

  • warnVulnerability

    Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation in github.com/mattermost/mattermost

  • warnVulnerability

    Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost with Jira plugin enabled has Incorrect Implementation of Authentication Algorithm in github.com/mattermost/mattermost-plugin-jira

  • warnVulnerability

    Mattermost fails to properly validate login method restrictions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly validate team membership when processing channel mentions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to enforce invite permissions when updating team settings in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to sanitize sensitive data in WebSocket messages in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly validate User-Agent header tokens in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to limit the size of responses from integration action endpoints in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to bound memory allocation when processing PSD image files in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows a removed team member to enumerate all public channels within a private team in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly handle very long passwords in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows attackers to spoof permalink embeds in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to bound memory allocation when processing DOC files in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to preserve the redacted state of burn-on-read posts during deletion in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to filter invite IDs based on user permissions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to use consistent error responses when handling the /mute command in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to properly enforce read permissions in search API endpoints in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to validate team-specific upload_file permissions in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost fails to validate user's authentication method when processing account auth type switch in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost: Authenticated DoS through failure to prevent rendering of external SVGs on link embeds in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost does not verify remote cluster channel access when processing shared channel membership removals in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't verify channel membership when processing AI-assisted message rewrites in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't sanitize sensitive configuration fields before including them in support packet generation in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't validate 7zip archive structure before processing in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows attackers to take over arbitrary user accounts via overly permissive substring matching flaw in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't check if {{team_id}} was being changed when updating playbooks in github.com/mattermost/mattermost-plugin-playbooks

  • warnVulnerability

    Mattermost doesn't validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't enforce client identity binding during the OAuth authorization code redemption flow in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't check public/private permissions in github.com/mattermost/mattermost-plugin-playbooks

  • warnVulnerability

    Mattermost doesn't validate CSRF tokens on an authentication endpoint in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has session spoofing due to lack of single-use consumption of guest magic link tokens enforcement in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost allows authenticated guest users to enumerate user IDs outside their allowed visibility scope in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't check the create_post channel permission during post edit operations in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't validate decompressed archive entry sizes during file extraction in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't validate the Host header when constructing response URLs for custom slash command in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't enforce slash command trigger-word uniqueness during command updates in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't prevent disclosure of created user password in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't validate the X-Requested-With header on the burn-on-read reveal endpoint in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't filter nil elements from outgoing webhook attachment payloads before processing in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't validate that a username returned during bot registration belongs to a bot account in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't require system-level permission when patching protected default system roles in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost has an Incorrect Authorization issue in github.com/mattermost/mattermost-server

  • warnVulnerability

    Mattermost Uncontrolled Resource Consumption vulnerability (fixed in 7.8.10)

  • warnVulnerability

    Mattermost Uncontrolled Resource Consumption vulnerability (fixed in 7.8.13)

  • warnVulnerability

    Mattermost vulnerable to information disclosure (fixed in 7.1.6)

  • warnVulnerability

    Mattermost Server Missing Authorization vulnerability (fixed in 7.8.5)

  • warnVulnerability

    Mattermost Open Redirect vulnerability (fixed in 7.8.13)

  • warnVulnerability

    Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability (fixed in 7.8.14)

  • warnVulnerability

    Mattermost vulnerable to cross-site scripting (XSS) (fixed in 7.1.6)

  • warnVulnerability

    Mattermost does not validate requesting user permissions before updating admin details (fixed in 7.8.8)

  • warnVulnerability

    Mattermost Injection vulnerability (fixed in 7.8.14)

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability (fixed in 7.1.8)

  • warnVulnerability

    Mattermost Improper Access Control vulnerability (fixed in 7.8.13)

  • warnVulnerability

    Mattermost vulnerable to information disclosure (fixed in 7.1.6)

  • warnVulnerability

    Mattermost fails to properly authentication inviter's permissions to private channel (fixed in 7.1.6)

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability (fixed in 7.8.10)

  • warnVulnerability

    Mattermost fails to sanitize post metadata (fixed in 7.8.8)

  • warnVulnerability

    Mattermost Uncontrolled Resource Consumption vulnerability (fixed in 7.8.13)

  • warnVulnerability

    Mattermost Fails to Validate File Paths

  • warnVulnerability

    Mattermost has Potential Server Crash due to Unvalidated Import Data

  • warnVulnerability

    Mattermost Incorrect Authorization vulnerability (fixed in 7.8.10)

  • warnVulnerability

    Mattermost Uncontrolled Resource Consumption vulnerability (fixed in 7.8.13)

  • warnVulnerability

    Mattermost Improper Access Control vulnerability (fixed in 7.8.13)

  • warnVulnerability

    Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability (fixed in 7.8.13)

  • warnVulnerability

    Mattermost fails to check if user is a guest before performing actions on public playbooks (fixed in 7.8.8)

  • warnVulnerability

    Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability (fixed in 7.8.13)

  • warnVulnerability

    Mattermost notified all users in the channel when using WebSockets to respond individually (fixed in 8.1.7)

  • warnVulnerability

    Mattermost Does Not Sanitize the Team Invite ID

  • warnVulnerability

    Mattermost password hash disclosure vulnerability (fixed in 7.8.12)

  • warnVulnerability

    Mattermost vulnerable to excessive memory consumption (fixed in 7.8.12)

  • warnVulnerability

    Mattermost viewing archived public channels permissions vulnerability (fixed in 7.8.10)

  • warnVulnerability

    Mattermost Fails to Sanitize Path Traversal Sequences

  • warnVulnerability

    Mattermost denial of service vulnerability (fixed in 7.8.12)

What the code does

On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.

Source patterns

Patterns found in the source, including those malware is known to use.

  • capability-filesystem-read
  • capability-filesystem-write-executable
  • capability-network-download
  • capability-network-lolbas
  • capability-network-outbound
  • capability-process-spawn
  • threat-filesystem-read
  • threat-network-exfiltration
  • threat-runtime-environment-read

Check every dependency before it installs

This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.

Start free How it works