1190 matches found
CVE-2017-9769
https://nvd.nist.gov/vuln/detail/CVE-2017-9769 CVE-2017-9769 可以向 Razer Synapse 2.20.15.1104 中的 rzpnk.sys 驱动程序发送特制的 IOCTL，该 IOCTL 被转发到 ZwOpenProcess，从而允许打开任意进程的句柄。 参考 https://www.godeye.club/cve/2020/11/06/001.html...
CVE-2024-29404_Razer
CVE-2024-29404 Razer Synapse 3 =Synapse版本 3.9.131.20813 应用版本 =20240213 "Chroma Effects" 功能存在通过任意文件/文件夹删除导致的权限提升漏洞 https://github.com/user-attachments/assets/6528f166-5514-4b10-b1a4-3644ec11e772...
RazerEoP
RazerEoP PoC para la eliminación/movimiento arbitrario de archivos en el módulo de macros de Razer Synapse 3. Este módulo permite al usuario exportar macros creadas a un archivo en disco, y la operación de archivo se realiza a través del servicio de Razer que se ejecuta como nt authority\system...
synapse
========================================================================= Synapse |support| |development| |documentation| |license| |pypi| |python| Synapse 现已积极维护于 element-hq/synapse Synapse 是一个开源的 Matrix 家服务器，由 Matrix.org 基金会从 2019 年到 2023 年开发。Matrix.org 基金会无法继续维护 Synapse，其 由 Element 继续开发...
CVE-2026-12283
Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL...
CVE-2026-12283 SQL injection in Amazon Athena Synapse connector
Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL...
CVE-2026-12283 SQL injection in Amazon Athena Synapse connector
Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL...
CVE-2026-12283 SQL injection in Amazon Athena Synapse connector
Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feature that allows you to connect to data sources outside of Amazon S3 like DynamoDB, Azure Synapse, and custom connectors using standard SQL...
CVE-2026-12283
CVE-2026-12283 affects Amazon Athena Query Federation's Synapse connector (aws-athena-query-federation) v2022.20.1–v2026.19.1. The issue is improper neutralization of elements in an SQL command within the Synapse connector, which could let an authenticated remote user execute injected read-only S...
PYSEC-2026-2620 matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID...
PYSEC-2026-1612 Synapse's invalid device keys degrade federation functionality
Impact Lack of validation for device keys in Synapse before 1.138.3 and in Synapse 1.139.0 allow an attacker registered on the victim homeserver to degrade federation functionality, unpredictably breaking outbound federation to other homeservers. Patches Patched in Synapse 1.138.3, 1.138.4,...
PYSEC-2026-1614 Synapse vulnerable to federation denial of service via malformed events
Impact A malicious server can craft events with a depth outside the integer range allowed by Canonical JSON. When such an event is received by Synapse version up to 1.127.0, it prevents it from federating with other servers. The vulnerability has been exploited in the wild. Patches Fixed in Synap...
PYSEC-2026-1610 Synapse Matrix has a partial room state leak via Sliding Sync
Impact The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. Patches Synapse version 1.120.1 fixes the problem. Workarounds Disable Sliding Sync. References...
PYSEC-2026-1611 Synapse allows a a malformed invite to break the invitee's `/sync`
Impact Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Patches Synapse 1.120.1 rejects such invalid invites received ov...
PYSEC-2026-1613 Synapse allows unsupported content types to lead to memory exhaustion
Impact In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Patches Synapse 1.120.1 resolves the issue by denying...
PYSEC-2026-1615 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
Impact In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing. This significantly expands...
Matrix Synapse DoS
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...
PYSEC-2026-846 Matrix Synapse DoS
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...
PYSEC-2026-845 Matrix Synapse Improper Signature Validation
Matrix Synapse before 0.33.3.1 and 0.33.2.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation...