Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
Mattermost Server exposes sensitive information via its System Console UI CVE-2016-11078, GHSA-9w4v-9c99-hv7r, GO-2025-4057 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows System Admin to modify LDAP account names and email addresses CVE-2016-11077, GHSA-mj8v-773w-5qhj, GO-2025-4060 | Low | 0.6% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not check if cookies are used over SSL CVE-2016-11076, GHSA-379p-37xc-q963, GO-2025-4054 | High | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes sensitive information about team URLs via an API CVE-2016-11075, GHSA-q3g9-hgrx-hwhx, GO-2025-4061 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server: Insufficient Password-Reset Link Invalidation CVE-2016-11074, GHSA-j26g-95ph-2mwv, GO-2025-4059 | Critical | 1.2% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS via a Legal or Support setting CVE-2016-11073, GHSA-9jrx-fgrm-96qh, GO-2025-4056 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server's Session ID and Session Token are potentially compromised CVE-2016-11072, GHSA-43m6-wvc8-2m7j, GO-2025-4055 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener` CVE-2016-11071, GHSA-h3qg-w9j5-wh3m, GO-2025-4058 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through customizable theme color-code values CVE-2016-11070, GHSA-h8qw-xqm9-q66j, GO-2025-4050 | Medium | 0.6% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not enforce rate limits on password change attempts CVE-2016-11069, GHSA-qrf6-h5fc-7m96, GO-2025-4051 | High | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Code Injection through its LDAP fields CVE-2016-11068, GHSA-7vmw-6c7h-rrrv, GO-2025-4048 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Uncontrolled Resource Consumption CVE-2016-11067, GHSA-ffcc-qr2v-3qmv, GO-2025-4046 | Medium | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server: initial_load API exposes unnecessary information CVE-2016-11066, GHSA-r93j-3mmp-px57, GO-2025-4047 | High | 1.2% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to Cross-site Scripting through file preview feature CVE-2016-11063, GHSA-cffj-7w5c-jqjh, GO-2025-4045 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows an attacker to specify a full pathname of a log file CVE-2017-18912, GHSA-m2ch-x2q7-2284, GO-2026-4487 | Critical | 1.4% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server has X.509 Improper Certificate Validation CVE-2017-18911, GHSA-m462-mqw4-2c8m, GO-2026-4464 | Critical | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server SAML implementation does not require encryption or signature verification as default CVE-2017-18909, GHSA-r6j5-fqx9-7qv9, GO-2026-4478 | High | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to XSS via an uploaded file CVE-2017-18904, GHSA-8pff-p3gx-w4jf, GO-2026-4302 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to CSRF if CORS is enabled CVE-2017-18903, GHSA-fcwg-45jh-5qhf, GO-2026-4305 | High | 0.4% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes team invite IDs through API endpoints CVE-2017-18902, GHSA-jwfv-5hwq-f97r, GO-2025-4185 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes private team invite ID CVE-2017-18901, GHSA-c253-8hr4-r8v9, GO-2026-4304 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable CSV Injection CVE-2017-18900, GHSA-8q4v-35v6-g8wr, GO-2026-4303 | Critical | 1.3% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to DoS through maliciously crafted posts CVE-2017-18898, GHSA-9589-mq83-f749, GO-2026-4300 | Medium | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server mishandles redirect denial action CVE-2017-18897, GHSA-f7c3-7vp3-44p6, GO-2026-4301 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows attackers to log sensitive information via DEBUG REST API logging endpoint CVE-2017-18896, GHSA-63wg-qmrv-7q66, GO-2026-4299 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes sensitive user status information via REST API version 4 endpoint CVE-2017-18895, GHSA-h742-xx59-r9pq, GO-2026-4295 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server has intermittent Authorization bypass for resource-owners CVE-2017-18894, GHSA-gg42-mwr6-p82c, GO-2026-4297 | High | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through display name field CVE-2017-18893, GHSA-887v-xh2x-47cm, GO-2026-4296 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not neutralize HTML content in an Email template field CVE-2017-18892, GHSA-wj5w-qghh-gvqp, GO-2026-4317 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not safeguard against phishing via error page links CVE-2017-18891, GHSA-vrh2-rprg-rgc6, GO-2026-4298 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows attackers to create buttons that can launch API requests CVE-2017-18890, GHSA-m497-hq5x-6jcv, GO-2025-4202 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to webhook and slash command manipulation CVE-2017-18889, GHSA-jp57-4x34-5v94, GO-2025-4201 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to SQL Injection when executing multiple POST requests CVE-2017-18888, GHSA-v2vm-hq26-5jv6, GO-2025-4203 | Critical | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes team creator's e-mail address to other members CVE-2017-18887, GHSA-35c4-5qfp-wxj6, GO-2025-4199 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not properly restrict use of slash commands CVE-2017-18886, GHSA-wvjg-33p9-938h, GO-2025-4204 | High | 1.0% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows attackers to gain privileges by accessing unintended API endpoints with users' credentials CVE-2017-18885, GHSA-g78f-6xq7-rrhq, GO-2025-4200 | Critical | 1.2% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server exposes OAuth personal access tokens to attackers CVE-2017-18884, GHSA-876j-jfqf-m7j7, GO-2025-4197 | Critical | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider CVE-2017-18883, GHSA-w8cc-3h7q-jhc3, GO-2025-4198 | Critical | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS through author_link field in Slack attachments CVE-2017-18879, GHSA-498j-wxww-j897, GO-2025-4189 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server allows users with a session ID to revoke another users' session CVE-2017-18878, GHSA-h564-6gc2-fcc6, GO-2025-4191 | Medium | 0.8% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Directory Traversal by System Admins CVE-2017-18874, GHSA-8qg8-c7mw-6fj7, GO-2025-4148 | Medium | 1.2% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to channel invisibility DoS via misformatted post CVE-2017-18873, GHSA-x6mw-hf2j-vqpc, GO-2026-4282 | Medium | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server's OAuth 2.0 service is vulnerable to attack through Missing Authorization CVE-2017-18872, GHSA-hgrp-fgm8-56g8, GO-2025-4075 | Medium | 0.6% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page CVE-2017-18877, GHSA-9x8x-w6g5-hx4w, GO-2025-4190 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server is vulnerable to Path Traversal when files are stored locally CVE-2017-18876, GHSA-hjqh-j6rj-gh8q, GO-2025-4187 | Medium | 0.9% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server does not prevent System Admin from arbitrary file creation CVE-2017-18875, GHSA-9rr5-q43r-ccv4, GO-2025-4186 | Medium | 0.7% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names CVE-2017-18871, GHSA-jc6w-8r7f-vmp5, GO-2025-4184 | High | 1.1% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
CVE-2017-18870 in github.com/mattermost/mattermost-server CVE-2017-18870, GHSA-9j9j-mm2r-9rfm, GO-2025-4183 | Medium | 0.6% | 19 Jun, 2020 | Go github.com/mattermost/mattermost-server |
Grafana XSS via adding a link in General feature CVE-2018-18625, GHSA-6wh2-8hw7-jw94, GO-2024-2483 | Medium | 1.4% | 02 Jun, 2020 | Go github.com/grafana/grafana |
Grafana XSS via a column style CVE-2018-18624, GHSA-9hv8-4frf-cprf, GO-2024-2516 | Medium | 1.4% | 02 Jun, 2020 | Go github.com/grafana/grafana |