CVE-2021-39164 Improper authorisation of /members discloses room membership to non-members

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership list of members, with their display names of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history...

CVE-2021-39164

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership list of members, with their display names of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history...

CVE-2021-39163

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where the vulnerable...

@amitport/koangular-users (0.0.0), @antimatter-studios/dredd (>=14.1.0, <=16.1.0) +205 more potentially affected by CVE-2020-7709 +2 more via json-pointer (>=0.0.4, <=0.6.1)

json-pointer NPM version =0.0.4, =14.1.0, =0.0.1, =0.0.2, =0.0.1, =1.2.6, =2.7.2, =1.0.0, =0.0.0-development, =1.0.0, =2.21.3, =9.0.0, =2.0.0, =0.0.1, =0.1.0 and more Source cves: CVE-2020-7709, CVE-2021-23820, CVE-2022-4742 Source advisory: SNYK:JS-JSONPOINTER-1577287...

ckb-analyzer (0.39.2), ckb-app-config (>=0.37.0-pre, <=0.100.0-rc2) +57 more potentially affected by CVE-2021-45697 via molecule (>=0.2.5, <=0.7.1)

molecule CARGO version =0.2.5, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.40.0, =0.40.0, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.1.0, =0.37.0-pre, =0.39.1 and more Source cves: CVE-2021-45697 Source advisory: OSV:GHSA-82HM-VH7G-HRH9...

amethyst (>=0.11.0, <=0.15.3), amethyst-console (0.1.0) +22 more potentially affected by CVE-2021-25902 via glsl-layout (0.3.2)

glsl-layout CARGO version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on glsl-layout and may be impacted: - amethyst =0.11.0, =0.2.0, =0.1.0, =0.6.0, =0.6.0, =0.6.0, =0.4.0, =0.6.0, =0.1.0, =0.2.0, =0.1.0, =0.6.0, =0.15.3 and more Source cves:...

akaze (>=0.1.0, <=0.1.2), babelfish (>=0.1.0, <=0.1.1) +73 more potentially affected by CVE-2019-25001 via serde_cbor (>=0.3.3, <=0.9.0)

serdecbor CARGO version =0.3.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.10.0, =0.10.0, =0.10.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.3 - ec-client 0.1.0 and more Source cves: CVE-2019-25001 Source advisory: OSV:GHSA-XR7R-88QV-Q7HM...

acme-client (>=0.1.0, <=0.2.0), aerial (0.1.0) +700 more potentially affected by CVE-2017-18589 via cookie (>=0.1.21, <=0.6.2)

cookie CARGO version =0.1.21, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.7.0, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.5.0, =0.6.5 and more Source cves: CVE-2017-18589 Source advisory: OSV:GHSA-VJRQ-CG9X-RFJP...

RUSTSEC-2021-0099 Crate has been renamed to `cosmrs`

The cosmossdk crate, which provides a basic Rust SDK for the Cosmos ecosystem, has rebranded to “CosmRS” in the spirit of other projects like CosmJS and CosmWasm. You can find the new home here: https://github.com/cosmos/cosmos-rust/tree/main/cosmrs The new crate name is cosmrs:...

Crate has been renamed to `cosmrs`

The cosmossdk crate, which provides a basic Rust SDK for the Cosmos ecosystem, has rebranded to “CosmRS” in the spirit of other projects like CosmJS and CosmWasm. You can find the new home here: https://github.com/cosmos/cosmos-rust/tree/main/cosmrs The new crate name is cosmrs:...

Cybercriminals Selling Access to Compromised Networks: 3 Surprising Research Findings

Cybercriminals are innovative, always finding ways to adapt to new circumstances and opportunities. The proof of this can be seen in the rise of a certain variety of activity on the dark web: the sale of access to compromised networks. This type of dark web activity has existed for decades, but i...

Fedora: Security Advisory for rust-actix-http (FEDORA-2021-98066afb33)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

2021 Mid-Year WordPress Security Report: A Collaboration Between Wordfence and WPScan

Wordfence has collaborated with WPScan to conduct a 2021 mid-year review on the state of WordPress security. Using attack data from Wordfence’s internal threat intelligence platform, and vulnerability data from WPScan’s vulnerability database, we were able to analyze the current trend of attacks ...

[SECURITY] Fedora 34 Update: matrix-synapse-1.38.1-1.fc34

Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is intended to showcase the concept of Matrix and let folks see the spec in...

Apple Patches Actively Exploited Zero-Day in iOS, MacOS

Apple patched a zero-day flaw on Monday, found in both its iOS and macOS platforms that’s being actively exploited in the wild and can allow attackers to take over an affected system. The memory-corruption flaw, tracked as CVE-2021-30807, is found in the IOMobileFrameBuffer extension which exists...

@fley_real/notification-manager (1.0.0), @nbish11/test (>=1.0.2, <=1.2.0) +53 more potentially affected by CVE-2021-23432 via mootools (>=1.3.2, <=1.5.2)

mootools NPM version =1.3.2, =1.0.2, =0.1.2, =0.1.0, =0.8.3, =1.0.0, =0.9.3, =1.3.0, =0.0.2, =0.4.0, =0.2.0, =0.2.0, =1.0.5, =2.0.2 and more Source cves: CVE-2021-23432 Source advisory: SNYK:JS-MOOTOOLS-1325536...

Researchers: NSO Group’s Pegasus Spyware Should Spark Bans, Apple Accountability

News of a zero-click zero-day in Apple’s iMessage feature being incorporated into the notorious Pegasus mobile spyware from NSO Group has drawn a variety of reactions from the security community, including concerns about the security of Apple’s closed ecosystem, and varying views on NSO Group’s...

A New Security Paradigm: External Attack Surface Management

Ran Nahmias, Co-founder and CBO, Cyberpion In the past, a web application or online service could be taken at face value by your customers and employees. It was created, developed, and secured by your organization, and every element of the IT infrastructure that supported that service was under...

CVE-2021-32773

CVE-2021-32773 affects the Racket sandbox prior to version 8.2. In those versions, code evaluated in the sandbox could cause system modules to erroneously use attacker-created modules instead of their intended dependencies, allowing attackers to control system functions and access restricted faci...

@adv-ui/nc-strings (3.2.0), @arshad/gatsby-theme-phoenix (>=1.1.0, <=1.1.8) +154 more potentially affected by CVE-2021-32696 via striptags (>=3.0.0, <=3.1.1)

striptags NPM version =3.0.0, =1.1.0, =1.0.0, =0.1.0, =0.3.0, =1.1.1-alpha.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.3.3, =1.0.2, =1.0.6 and more Source cves: CVE-2021-32696 Source advisory: OSV:GHSA-QXG5-2QFF-P49R...