Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
matrix synapse vulnerabilities and exploits
(subscribe to this query)
445
VMScore
CVE-2019-11842
An issue exists in Matrix Sydent prior to 1.0.3 and Synapse prior to 0.99.3.1. Random number generation is mishandled, which makes it easier for malicious users to predict a Sydent authentication token or a Synapse random ID.
Matrix Synapse
Matrix Sydent
445
VMScore
CVE-2018-12291
The on_get_missing_events function in handlers/federation.py in Matrix Synapse prior to 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.
Matrix Synapse
445
VMScore
CVE-2018-10657
Matrix Synapse prior to 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py, as exploited in the wild in April 2018.
Matrix Synapse
NA
CVE-2022-39374
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the curre...
Matrix Synapse
668
VMScore
CVE-2019-18835
Matrix Synapse prior to 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.
Matrix Synapse
NA
CVE-2022-31152
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event...
Matrix Synapse
383
VMScore
CVE-2020-26891
AuthRestServlet in Matrix Synapse prior to 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. This allows a remote malicious user to execute an XSS attack on the domain Synapse is hosted on, by supplying the victim user with a malicious URL to t...
Matrix Synapse
NA
CVE-2023-32682
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for...
Matrix Synapse
NA
CVE-2023-32683
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addres...
Matrix Synapse
445
VMScore
CVE-2018-12423
In Synapse prior to 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
Matrix Synapse
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-30310
CVE-2024-21683
CVE-2024-22187
chrome
deserialization
XPath injection
CVE-2024-27842
denial of service
CVE-2024-24851
google
CVE-2024-35400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
NEXT »