Mattermost — безопасная платформа для совместной работы, позволяющая объединить ваши команды, инструменты и процессы для ускорения критически важной работы.

Mattermost fails to use  innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though. 

Mattermost fails to use innerText /textContentwhen setting the channel ...

Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to override the username and profile picture when posting, a member could also override the username and icon when making a post even if the Hardened Mode setting was enabled

Mattermost fails to check if hardened mode is enabled when overriding ...

Mattermost denial of service vulnerability

Mattermost password hash disclosure vulnerability

Mattermost vulnerable to excessive memory consumption

Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_location, to fill up the memory due to caching large items.

Mattermost fails to properly sanitize the request to/api/v4/redirect_l ...

Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body.