5034 matches found
matrix-synapse-testutils (>=1.66.0.0, <=1.92.2.0) potentially affected by CVE-2023-41335 via matrix-synapse (>=1.66.0, <=1.92.2)
matrix-synapse PYPI version =1.66.0, =1.66.0.0, =1.92.2.0 Source cves: CVE-2023-41335 Source advisory: OSV:GHSA-4F74-84V3-J9Q5...
matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
Impact When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be...
CVE-2023-42453: Improper Authorization
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Users were able to forge read receipts for any event if they knew the room ID and event ID. Note that the users were not able to view the events, but simply mark it as read. This could be confusing as...
Fedora: Security Advisory for python-matrix-common (FEDORA-2023-c0696d7b53)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory for matrix-synapse (FEDORA-2023-c0696d7b53)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-34999
A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 5.7.6 and v6 6.5.0 that allows an attacker to perform arbitrary code execution via the admin web interface...
Command injection
A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 5.7.6 and v6 6.5.0 that allows an attacker to perform arbitrary code execution via the admin web interface...
CVE-2023-34999
A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 5.7.6 and v6 6.5.0 that allows an attacker to perform arbitrary code execution via the admin web interface...
CVE-2023-34999
A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 5.7.6 and v6 6.5.0 that allows an attacker to perform arbitrary code execution via the admin web interface...
CVE-2023-34999
The CVE-2023-34999 entry concerns RTS VLink Virtual Matrix Software versions 5 (< 5.7.6) and 6 (
[SECURITY] Fedora 37 Update: python-matrix-common-1.3.0-7.fc37
Common utilities for Synapse, Sydent and Sygnal...
[SECURITY] Fedora 37 Update: matrix-synapse-1.80.0-5.fc37
Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is intended to showcase the concept of Matrix and let folks see the spec in...
RTS VLink Virtual Matrix Command Injection Vulnerability
RTS VLink Virtual Matrix is a virtual matrix system from RTS that is commonly used in video surveillance and audio communications. The RTS VLink Virtual Matrix suffers from a command injection vulnerability that stems from the presence of a command injection vulnerability that allows an attacker ...
CVE-2023-34999: Improper Control of Generation of Code
A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 5.7.6 and v6 6.5.0 that allows an attacker to perform arbitrary code execution via the admin web interface...
Fedora 37 : matrix-synapse / python-matrix-common / rust-pythonize (2023-c0696d7b53)
The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-c0696d7b53 advisory. Update matrix-synapse to v1.80.0 to fix CVE-2022-39374, CVE-2023-32323 Tenable has extracted the preceding description block directly from the Fedor...
Cross Site Scripting (XSS)
matrix-media-repo is vulnerable to a Cross Site Scripting XSS. The vulnerability is due to a lack of content-type validation, which allows an attacker to upload a SVG image containing JavaScript leading to the execution of JavaScript in the user’s browser...
CVE-2023-41318
CVE-2023-41318 affects matrix-media-repo and concerns an SVG/script execution vulnerability when a malicious media is uploaded and served with Content-Disposition: inline. Affected component is the matrix-media-repo media repository; the underlying cause is unsafe handling of media that can lead ...
CVE-2023-41318 Unsafe media served inline on download endpoints in matrix-media-repo
matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with Content-Disposition: inline upon download. This vulnerability could b...
CVE-2023-41318
matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with Content-Disposition: inline upon download. This vulnerability could b...
CVE-2023-41318 Unsafe media served inline on download endpoints in matrix-media-repo
matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with Content-Disposition: inline upon download. This vulnerability could b...