Open Redirect

matrix-synapse is vulnerable to open redirect. The requests to the user provided domains are allowed to external IP addresses while using transitional IPv6 addresses, affecting outbound requests to federation, identity servers, when calculating the key validity for third-party invite events,...

Denial Of Service (DoS)

matrix-synapse is vulnerable to denial of service. Lack of input validation of some parameters on the endpoints used to confirm third-party identifiers could allows an attacker to cause excessive use of disk space and memory leading to resource exhaustion...

Denial Of Service (DoS)

matrix-synapse is vulnerable to denial of service. The vulnerability exists due to missing input validation of some parameters on the endpoints used to confirm third-party identifiers...

Design/Logic Flaw

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6...

PYSEC-2021-27

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party...

CVE-2021-21394 Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party...

Matrix Synapse 输入验证错误漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A security vulnerability was previously present in Synapse version 1.28.0, which stemmed from Synapse's lack of input validation of certain parameters used to validate third-party identifiers on...

Matrix Synapse 输入验证错误漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A security vulnerability was previously present in Synapse version 1.28.0, which stemmed from Synapse's lack of input validation of certain parameters used to validate third-party identifiers on...

Matrix Synapse Cross-Site Scripting Vulnerability (CNVD-2021-24348)

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A cross-site scripting vulnerability exists in Matrix Synapse versions prior to 1.27.0, which can be exploited by attackers to access cookies and other browser data...

HTML Injection

matrix-synapse is vulnerable to HTML injection. Lack of output sanitization of the notification emails that are sent for notifications for missed messages or for an expiring account allows an attacker to inject and execute arbitrary HTML code in a user's browser...

UBUNTU-CVE-2021-21332

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the password reset endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The...

UBUNTU-CVE-2021-21333

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.27.0, the notification emails sent for notifications for missed messages or for an expiring account are subject...

Matrix Synapse 跨站脚本漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A cross-site scripting vulnerability was previously present in Matrix Synapse version 1.27.0, which allowed an attacker to exploit the vulnerability to insert forged content into an email message...

Apache Synapse 跨站脚本漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A cross-site scripting vulnerability exists in Matrix Synapse versions prior to 1.27.0, which can be exploited by attackers to access cookies and other browser data...

Matrix Synapse Denial of Service Vulnerability (CNVD-2021-15493)

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A denial of service vulnerability exists in Synapse versions prior to 1.25.0, which stems from a malicious homeserver that redirects requests to a large file, which could lead to a denial of service...

Denial Of Service (DoS)

matrix-synapse is vulnerable to denial of service. A malicious homeserver is able to redirect requests to a very large .well-known file that leads to a denial of service condition where homeservers will consume significantly more resources when requesting the malicious .well-known file...

Denial Of Service (DoS)

matrix-synapse is vulnerable to denial of service DoS. The vulnerability exists as a malicious homeserver could redirect requests to their .well-known file to a large file...

DEBIAN-CVE-2021-21274

Synapse is a Matrix reference homeserver written in python pypi package matrix-synapse. Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.25.0, a malicious homeserver could redirect requests to their .well-known file to a large file. This can lead t...

Matrix Synapse Input Validation Error Vulnerability

Matrix Synapse is an implementation of a matrix management server from the Matrix Foundation in the UK. A security vulnerability exists in Synapse that stems from a request to a user-provided domain being unrestricted by an external IP address when calculating key validity for third-party...

Matrix Synapse 资源管理错误漏洞

Matrix Synapse is a Matrix Management Server implementation from the Matrix Foundation in the UK. A denial of service vulnerability exists in Synapse versions prior to 1.25.0, which stems from a malicious homeserver that redirects requests to a large file, which could lead to a denial of service...