Security Vulnerabilities - CVEs Published In 2020
An issue was discovered in Mattermost Server before 5.18.0. It allows attackers to cause a denial of service (memory consumption) via a large Slack import.
CVSS Score
7.5
EPSS Score
0.011
Published
2020-06-19
An issue was discovered in Mattermost Server before 5.18.0. It has weak permissions for server-local file storage.
CVSS Score
7.5
EPSS Score
0.011
Published
2020-06-19
An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel.
CVSS Score
5.3
EPSS Score
0.008
Published
2020-06-19
An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies.
CVSS Score
7.5
EPSS Score
0.009
Published
2020-06-19
An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout.
CVSS Score
5.3
EPSS Score
0.009
Published
2020-06-19
An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout.
CVSS Score
5.3
EPSS Score
0.009
Published
2020-06-19
CALDERA 2.7.0 allows XSS via the Operation Name box.
CVSS Score
5.4
EPSS Score
0.006
Published
2020-06-19
Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
CVSS Score
7.8
EPSS Score
0.003
Published
2020-06-19
In all versions of package casperjs, the mergeObjects utility function is susceptible to Prototype Pollution.
CVSS Score
7.3
EPSS Score
0.02
Published
2020-06-19
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors.
CVSS Score
8.1
EPSS Score
0.021
Published
2020-06-19