Monthly Archive: June 2020

An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment migration. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX message. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execution problem. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message content). Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel. Date published : 2020-06-19 https://mattermost.com/security-updates/

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. There are weak permissions for configuration files. Date published : 2020-06-19 https://mattermost.com/security-updates/