CVE-2018-12291

Summary: Matrix Synapse before 0.31.1 has a bug in on_get_missing_events ( federation.py ) where event visibility rules were not applied correctly in get_missing_events, potentially exposing incorrect events. Impact: as described in multiple advisories; CVE-2018-12291. Remediation: upgrade to Syn...

CVE-2018-12291: Undefined Security Weakness

The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly...

PT-2018-11098

Name of the Vulnerable Software and Affected Versions Matrix Synapse versions prior to 0.31.1 Description The issue concerns a security bug in the get missing events federation API, specifically in the on get missing events function, where event visibility rules were not applied correctly...

Oracle Access Manager 11.1.2.3.0 / 12.2.1.3.0 Authentication Bypass Vulnerability

Oracle Access Manager versions 11.1.2.3.0 and 12.2.1.3.0 suffer from an authentication bypass vulnerability. We have published an accompanying blog post to this technical advisory with further information: Blog: https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

DEBIAN-CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

UBUNTU-CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

PT-2018-10035

Name of the Vulnerable Software and Affected Versions Matrix Synapse versions prior to 0.28.1 Description The issue is a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable. This is related to the files federation/federation base.py and...

CVE-2018-10657: Improper Input Validation

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

VulnCheck KEV: CVE-2018-10657

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

HP IceWall Federation Agent Information Disclosure Vulnerability

HP IceWall Federation Agent is a suite of access control software. The software enables single sign-on by working with authentication in public and private clouds. An information disclosure vulnerability exists in HP IceWall Federation Agent version 3.0. A remote attacker could exploit this...

CVE-2017-8945

A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Federation Agent version 3.0 was found...

Information disclosure

A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Federation Agent version 3.0 was found...

CVE-2017-8945

CVE-2017-8945 concerns HPE IceWall Federation Agent v3.0 with a remote unauthorized information disclosure vulnerability. The CNVD entry describes an information disclosure issue that could enable a remote attacker to redirect users to an arbitrary website and conduct a phishing attack. Details a...

CVE-2017-8945

A Remote Unauthorized Disclosure of Information vulnerability in HPE IceWall Federation Agent version 3.0 was found...

PT-2018-8456

Name of the Vulnerable Software and Affected Versions HPE IceWall Federation Agent version 3.0 Description A Remote Unauthorized Disclosure of Information issue was discovered. Recommendations For HPE IceWall Federation Agent version 3.0, at the moment, there is no information about a newer versi...