CVE-2024-4182

MEDIUM Year: 2024
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-754
View all →

Vulnerability Description

Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status.

Related Vulnerabilities

CVE-2018-25007

MEDIUM
CVSS:4.3(Medium)

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values...

CWE-7542018

CVE-2020-3449

MEDIUM
CVSS:4.3(Medium)

A vulnerability in the Border Gateway Protocol (BGP) additional paths feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to prevent authorized users from monitoring the B...

CWE-7542020

CVE-2021-33605

MEDIUM
CVSS:4.3(Medium)

Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4....

CWE-7542021

CVE-2022-45854

MEDIUM
CVSS:4.3(Medium)

An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to cause a temporary denial-of-service (DoS) by sending crafted V...

CWE-7542022

CVE-2023-45922

MEDIUM
CVSS:4.3(Medium)

glx_pbuffer.c in Mesa 23.0.4 was discovered to contain a segmentation violation when calling __glXGetDrawableAttribute(). NOTE: this is disputed because there are no common situations in which users r...

CWE-7542023

CVE-2023-5967

MEDIUM
CVSS:4.3(Medium)

Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and crash the Calls plugin

CWE-7542023