Information Disclosure

matrixsynapse is vulnerable to Information Disclosure. The vulnerability is caused by a missing validation check for the userid parameter used to query cached device information of remote users. This can lead to enumerating the remote users known to a homeserver...

Denial Of Service (DoS)

matrixsynapse is vulnerable to Denial Of Service DoS. The vulnerability is due to malicious server ACL events which can impact performance temporarily or permanently, leading to a persistent denial of service DoS...

Denial Of Service (DoS)

matrixsynapse is vulnerable to denial of service DoS. The library does not properly limit the connection time while attempting to generate URL previews for media stream URLs when the URL preview functionality is enabled. The connections are terminated only after maxspidersize bytes have been...

Denial Of Service (DoS)

matrixsynapse is vulnerable to denial of service attacks. The vulnerability exists in the 'checkstateindependentauthrules' function in 'eventauth.py' due to a lack of validation event authorization which allows an attacker to craft a malicious event and crash the system...

Denial Of Service (DoS)

matrixsynapse is vulnerable to denial of service attacks. An authenticated attacker is able to exhaust the available stack space for the Synapse process due to unbounded recursion, resulting in a system crash. The deployments with urlpreviewenabled: true configuration are affected...

Denial Of Service (DoS)

matrixsynapse is vulnerable to denial of service. The vulnerability exists due to missing input validation of some parameters on the endpoints used to confirm third-party identifiers which could cause excessive use of disk space and memory leading to resource exhaustion...

Denial Of Service (DoS)

matrixsynapse is vulnerable to denial of service. An attacker is able to exploit the vulnerability by injecting certain eventmatch patterns that will lead the system to crash...

Cross-Site Scripting (XSS)

matrixsynapse is vulnerable to cross-site scripting XSS. A attacker is able to inject and execute arbitrary Javascript in a user's browser via the reCAPTCHA, consent terms of service, or single sign-on functions...