244 matches found
CVE-2023-37904 Discourse Race Condition in Accept Invite
Discourse is an open source discussion platform. Prior to version 3.0.6 of the stable branch and version 3.1.0.beta7 of the beta and tests-passed branches, more users than permitted could be created from invite links. The issue is patched in version 3.0.6 of the stable branch and version...
PT-2023-26173 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.6 of the stable branch Discourse versions prior to 3.1.0.beta7 of the beta and tests-passed branches Description: Discourse is an open source discussion platform. The issue allows more users than permitted to b...
Denial Of Service (DoS)
matrix-synapse is vulnerable to Denial Of Service DoS. The vulnerability exists due to a lack of validation in the inviteroomstate, which allows an attacker to generate maliciously large invites and crash the application...
CVE-2023-32323 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...
CVE-2023-32323 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disable...
GHSA-F3WC-3VXV-XMVR Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Impact A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y. Synapse instances with federation disabled are not affected. Details The Matrix protocol allows homeservers to provide an...
LinkedIn: CSRF that makes any user send invitations to the attacker by simply clicking on a link.
A CSRF vulnerability was found that allowed sending connection invitations without confirmation when a user clicked on a link...
Israel-based Spyware Firm QuaDream Targets High-Risk iPhones with Zero-Click Exploit
Threat actors using hacking tools from an Israeli surveillanceware vendor named QuaDream targeted at least five members of civil society in North America, Central Asia, Southeast Asia, Europe, and the Middle East. According to findings from a group of researchers from the Citizen Lab, the spyware...
Mattermost fails to properly authentication inviter's permissions to private channel
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. Issue Identifier: MMSA-2023-00137...
PT-2023-17234 · Unknown · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises when processing an email invite to a private channel on a team. Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite...
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from Mattermost's inability to verify an invitee's permission for a team's private channel when processing email invitations to the channel,...
CVE-2023-23397: The Notification Sound You Don’t Want to Hear
CVE-2023-23397: The Notification Sound You Don’t Want to Hear By Mark Bereza · March 17, 2023 This story was also written by John Dunlap. Overview During the March "Patch Tuesday" security update, a new Outlook security vulnerability was revealed as being exploited in the wild. This is a serious...
SUSE CVE-2021-21392
Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6...
SUSE CVE-2022-23485
Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...
CVE-2023-21432: Improper Authorization
Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner...
CVE-2023-21432
Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the owner...
PT-2023-18200 · Unknown · Smartthings
Name of the Vulnerable Software and Affected Versions: Smart Things versions prior to 1.7.93 Description: The issue is related to improper access control, allowing an attacker to invite others without the owner's authorization. Recommendations: For versions prior to 1.7.93, update to version 1.7....
CVE-2022-45292
User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted...
