Security Vulnerabilities - CVEs Published In 2020
An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed.
CVSS Score
7.5
EPSS Score
0.011
Published
2020-06-19
An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
CVSS Score
5.3
EPSS Score
0.008
Published
2020-06-19
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
CVSS Score
6.1
EPSS Score
0.007
Published
2020-06-19
An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
CVSS Score
9.8
EPSS Score
0.013
Published
2020-06-19
An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.
CVSS Score
4.3
EPSS Score
0.006
Published
2020-06-19
An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
CVSS Score
7.5
EPSS Score
0.012
Published
2020-06-19
An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
CVSS Score
5.3
EPSS Score
0.011
Published
2020-06-19
An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
CVSS Score
5.3
EPSS Score
0.009
Published
2020-06-19
Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do.
CVSS Score
7.5
EPSS Score
0.019
Published
2020-06-19
Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.
CVSS Score
5.3
EPSS Score
0.081
Published
2020-06-19