CVE Vulnerability Catalog

HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input using alternate or obfuscated JavaScript syntax. The endpoint reflects unsanitized user input in HTTP responses without adequate output encoding.

Creating a '2dsphere_bucket' index on a non-timeseries bucket collection will succeed, but any subsequent attempt to insert a document which triggers updating that index will crash the server. A similar issue occurs when creating 'queryable_encrypted_range' indices. This issue affects MongoDB Server v7.0 versions prior to 7.0.32, v8.0 versions prior to 8.0.21 and v8.2 versions prior to 8.2.6.

An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset functionality under /OutsideCmd.

A vulnerability allows an attacker in a privileged network position to leak sensitive information. A path handling issue was addressed with improved validation.

Dify before version 1.14.2 contains an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document using only the file's UUID. Attackers can access the /console/api/files/{file_id}/preview endpoint to extract sensitive content from documents without ownership or workspace permission verification.

Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integrity.

Wersje Mattermost 11.5.x do 11.5.1, 10.11.x do 10.11.13 oraz 11.4.x do 11.4.3 nie zapobiegają ujawnieniu haseł użytkowników, co pozwala złośliwemu atakującemu na podszywanie się pod użytkownika przy użyciu tych haseł.

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, and 11.4.x <= 11.4.3 fail to check public/private permissions, allowing members without these permissions to access public playbooks via /get.

Mattermost versions 11.5.x <= 11.5.1 and 11.4.x <= 11.4.3 fail to validate the X-Requested-With header on the burn-on-read reveal endpoint, allowing an authenticated channel member to force the reveal of a burn-on-read message without recipient consent via a crafted Markdown image tag. Mattermost Advisory ID: MMSA-2026-00636.

Mattermost versions 11.5.x <= 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites. An authenticated attacker can read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite endpoint.

Aplikacje Mattermost Desktop w wersjach <=6.1, 6.0.1 oraz 5.4.13.0 nie zapobiegają ładowaniu nieprawidłowego URL w oknie pop-up, co pozwala złośliwemu właścicielowi serwera na wielokrotne awarie aplikacji poprzez wywołanie {{window.open('javascript:alert()');}}.

Wtyczki Mattermost w wersjach <=11.5, 11.1.5, 10.13.11 oraz 11.3.4.0 nieprawidłowo sprawdzają uprawnienia podczas przetwarzania poleceń w wtyczce Gitlab. To pozwala zwykłym użytkownikom na odinstalowanie instancji lub skonfigurowanie połączeń webhook za pomocą poleceń {{gitlab instance {option}}} lub {{/gitlab webhook {option}}}.

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to enforce slash command trigger-word uniqueness during command updates. An authenticated team member with Manage Own Slash Commands permission can hijack and impersonate existing system or custom slash commands by editing their own slash command trigger to an already-registered trigger via the command update API.

Wersje wtyczek Mattermost do 11.5, 11.1.5, 10.13.11 oraz 11.3.4.0 nie sprawdzają poprawnie ważnych przestrzeni nazw, co pozwala użytkownikom wtyczek na tworzenie subskrypcji do grup, które nie zostały zatwierdzone, poprzez tworzenie grup o tym samym prefiksie co grupa zatwierdzona.

Wersje wtyczek Mattermost do 11.5, 11.1.5, 10.13.11 oraz 11.3.4.0 nie mają odpowiednich kontroli na poziomie API dotyczących grup, do których użytkownik może tworzyć zgłoszenia lub dodawać komentarze. Umożliwia to użytkownikowi, będącemu członkiem wielu grup, tworzenie zgłoszeń w zablokowanej grupie za pomocą bezpośrednich żądań API.

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate 7zip archive structure before processing, allowing an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted 7zip file with excessive folder declarations.

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to check the create_post channel permission during post edit operations. An authenticated attacker with revoked posting privileges can modify their existing posts via direct API requests to the post update and patch endpoints.

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to {{/api/v1/meetings}}.

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to validate that a remote cluster has access to a channel before processing membership removal requests during shared channel membership sync. A malicious remote cluster can remove any user from any channel, including private channels, via crafted membership sync messages targeting channels the remote cluster is not authorized to access.

A vulnerability has been found in Tencent WeKnora up to 0.3.6 in the getKnowledgeBaseForInitialization function of internal/handler/initialization.go in the Config API Endpoint component. Manipulation of the kbId argument leads to authorization bypass, and the attack can be initiated remotely. The exploit has been publicly disclosed and the vendor did not respond.