CVE-2024-52594 Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib

Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit c4f1e01 fixes this issue. Users are advised to upgrade. Users unable to upgrade shoul...

PT-2025-2449 · Unknown +1 · Matrix Media Repo +1

Name of the Vulnerable Software and Affected Versions: Matrix Media Repo versions prior to 1.3.5 Description: The issue allows an unauthenticated adversary to induce the system to download and cache large amounts of remote media files, resulting in unbounded disk consumption. This can lead to a...

PT-2025-3302 · Unknown +2 · Matrix Media Repo +4

Name of the Vulnerable Software and Affected Versions: Matrix Media Repo versions prior to 1.3.8 Description: The issue arises when SVG or JPEGXL thumbnailers are enabled, allowing a user to upload a file that claims to be one of these types and request a thumbnail, potentially invoking a differe...

PT-2025-2935 · Unknown +1 · Matrix Media Repo +1

Name of the Vulnerable Software and Affected Versions: Matrix Media Repo MMR versions prior to 1.3.8 Description: The issue arises when Matrix Media Repo MMR makes requests to other servers as part of its normal operation, and these servers return large amounts of JSON for parsing. During parsing...

matrix-media-repo 代码问题漏洞

matrix-media-repo is a highly configurable multi-domain media repository for Matrix open source by t2bot.io. A code issue vulnerability exists in matrix-media-repo versions prior to v1.3.8 that stems from vulnerability to a server-side request forgery attack that, under certain conditions, serves...

CVE-2024-36403: Allocation of Resources Without Limits or Throttling

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 is vulnerable to unbounded disk consumption, where an unauthenticated adversary can induce it to download and cache large amounts of remote media files. MMR's typical operating...

CVE-2024-36402: Improper Authentication

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then...

matrix-media-repo 安全漏洞

matrix-media-repo is a highly configurable multi-domain media repository for Matrix open-sourced by t2bot.io. A security vulnerability exists in matrix-media-repo versions prior to v1.3.8, which stems from requests made to other servers during normal operation. These resource owners can return...

Matrix 授权问题漏洞

Matrix is an ambitious new ecosystem for open federated instant messaging and VoIP. Matrix suffers from an authorization issue vulnerability that stems from allowing a remote participant to trigger the download and caching of remote media from a remote home server to a local media repository...

gomatrixserverlib 代码问题漏洞

gomatrixserverlib is a Go library from the Matrix Foundation. It is used for common functions required by Matrix servers. A code issue vulnerability exists in Gomatrixserverlib that stems from vulnerability to server-side request forgery attacks...

Matrix 安全漏洞

Matrix is a new ecosystem of Matrix open source for open federated instant messaging and VoIP. A security vulnerability exists in Matrix that stems from uncontrolled disk consumption, resulting in a denial of service...

CVE-2024-52791: Memory Allocation with Excessive Size Value

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part of normal operation, and these resource owners can return large amounts of JSON back to MMR for parsing. In parsing, MMR can consume large amounts of memory and...

CVE-2024-56515: Deserialization of Untrusted Data

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled they are disabled by default, a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in...

CVE-2024-52594: Server-Side Request Forgery (SSRF)

Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit c4f1e01 fixes this issue. Users are advised to upgrade. Users unable to upgrade shoul...

PT-2025-2932 · Unknown +1 · Gomatrixserverlib +1

Name of the Vulnerable Software and Affected Versions: Gomatrixserverlib affected versions not specified Description: Gomatrixserverlib is a Go library for matrix federation. It is vulnerable to server-side request forgery, serving content from a private network it can access, under certain...

CVE-2024-52602: Server-Side Request Forgery (SSRF)

Matrix Media Repo MMR is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo MMR is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrad...

PT-2025-2933 · Unknown +1 · Matrix Media Repo +1

Name of the Vulnerable Software and Affected Versions: Matrix Media Repo MMR versions prior to 1.3.8 Description: Matrix Media Repo MMR is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This issue allows MMR to serve...

matrix-media-repo 代码问题漏洞

matrix-media-repo is a highly configurable multi-domain media repository for Matrix in the t2bot.io open source. A code issue vulnerability exists in matrix-media-repo that stems from the fact that if Matrix Media Repo has SVG or JPEGXL thumbnails enabled, a user can upload files claiming to be o...

ABB Cylon Aspect 3.08.02 bbmdUpdate.php Remote Code Execution Vulnerability

ABB Cylon Aspect version 3.08.02 suffers from an authenticated blind command injection vulnerability. Input passed to several POST parameters is not properly sanitized when writing files, allowing attackers to execute arbitrary shell commands on the system. There is also an off-by-one error in...

CVE-2024-52813

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applicatio...