CVE-2021-37860

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-378617.5Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.CVE-2021-378625.4Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into CVE-2021-378635.7Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a c CVE-2021-378646.5Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to v CVE-2021-378655.7Mattermost 6.2 and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which al CVE-2021-378667.5Mattermost Boards plugin v0.10.0 and earlier fails to invalidate a session on the server-side when a user logged out of Boards, which allows CVE-2021-378674.3Mattermost Boards plugin v0.10.0 and earlier fails to protect email addresses of all users via one of the Boards APIs, which allows authenti CVE-2021-37877.8A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the M CVE-2021-37886.8An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access u CVE-2021-37894.6An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with phys CVE-2021-37906.5A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated CVE-2021-379099.8WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite to the registry witho