Game0V3R

**Name of the Vulnerable Software and Affected Versions** Mattermost Desktop App versions prior to 6.2 Mattermost Desktop App version 6.0.2 Mattermost Desktop App version 5.6.13.0 **Description** The application fails to validate payloads sent from the Mattermost Web App to the Desktop App. This allows a malicious server owner to crash the Desktop App by modifying a method payload to be malformed. **Recommendations** Update Mattermost Desktop App to a version newer than 6.2. Update Mattermost Desktop App to a version newer than 6.0.2. Update Mattermost Desktop App to a version newer than 5.6.13.0.

**Name of the Vulnerable Software and Affected Versions** Mattermost Desktop App versions prior to 6.1 Mattermost Desktop App version 5.5.13.0 **Description** The application fails to properly handle attempts to open extremely long URLs. A malicious server owner can cause the application to crash by including a script that calls the `window.open()` function with an excessively large URL. **Recommendations** Update Mattermost Desktop App versions prior to 6.1 to a newer version. Update Mattermost Desktop App version 5.5.13.0 to a newer version.

**Name of the Vulnerable Software and Affected Versions** Mattermost Desktop App versions prior to 6.1 **Description** The application fails to prevent invalid URLs from loading in pop-up windows. This allows a malicious server owner to repeatedly crash the application by calling the `window.open('javascript:alert()')` function. **Recommendations** Update to a version later than 6.1.

**Name of the Vulnerable Software and Affected Versions** Mattermost versions 11.4.x through 11.4.3 Mattermost versions 11.5.x through 11.5.1 **Description** An issue exists where the burn-on-read reveal endpoint fails to validate the 'X-Requested-With' header. This allows an authenticated channel member to force the reveal of a burn-on-read message without the recipient's consent by using a crafted Markdown image tag. **Recommendations** Update Mattermost versions 11.4.x through 11.4.3 to a version later than 11.4.3. Update Mattermost versions 11.5.x through 11.5.1 to a version later than 11.5.1.