|
253331
|
7.5 |
HIGH
Network
|
beronet
|
voice_over_internet_protocol_gateways_firmware
|
beroNet VoIP Gateways before 3.0.16 have a PHP script that allows downloading arbitrary files, including ones with credentials.
|
CWE-74
Injection
|
CVE-2017-18923
|
2024-11-21 12:21 |
2020-07-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
253332
|
9.8 |
CRITICAL
Network
|
libvncserver_project canonical opensuse fedoraproject siemens
|
libvncserver ubuntu_linux leap fedora simatic_itc1500_firmware simatic_itc1500_pro_firmware simatic_itc1900_firmware simatic_itc1900_pro_firmware simatic_itc2200_firmware s…
|
It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket fr…
|
CWE-787
Out-of-bounds Write
|
CVE-2017-18922
|
2024-11-21 12:21 |
2020-06-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
253333
|
6.1 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
|
CWE-79
Cross-site Scripting
|
CVE-2017-18921
|
2024-11-21 12:21 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
253334
|
9.8 |
CRITICAL
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.
|
NVD-CWE-Other
|
CVE-2017-18920
|
2024-11-21 12:21 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
253335
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.
|
CWE-287
Improper Authentication
|
CVE-2017-18919
|
2024-11-21 12:21 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
253336
|
4.9 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
|
CWE-295
Improper Certificate Validation
|
CVE-2017-18918
|
2024-11-21 12:21 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
253337
|
7.5 |
HIGH
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
|
CWE-916
Use of Password Hash With Insufficient Computational Effort
|
CVE-2017-18917
|
2024-11-21 12:21 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
253338
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
|
CWE-732
Incorrect Permission Assignment for Critical Resource
|
CVE-2017-18916
|
2024-11-21 12:21 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
253339
|
9.8 |
CRITICAL
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
|
CWE-276
Incorrect Default Permissions
|
CVE-2017-18915
|
2024-11-21 12:21 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
253340
|
5.3 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.
|
CWE-754
Improper Check for Unusual or Exceptional Conditions
|
CVE-2017-18914
|
2024-11-21 12:21 |
2020-06-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|