Synapse path traversal vulnerability

Synapse is an application. for open federated instant messaging and VoIPSynapse. versions prior to Synapse 1.47.1 contain a path traversal vulnerability that could be exploited by an attacker to bypass the authentication process and download files from a remote server to an arbitrary directory...

Whoc - A Container Image That Extracts The Underlying Container Runtime

A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform! WhoC at Defcon 29 Cloud Village Azurescape - whoc-powered research, the first cross-account container takeover in the...

Path Traversal

matrix-synapse is vulnerable to path traversal. An attacker can download files from a remote server into an arbitrary directory when a media repository is enabled, potentially outside of the configured directory...

GHSA-3HFW-X7GX-437C Path traversal in Matrix Synapse

Impact Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory. The last two directories and file name of the path are chosen randomly by Synapse and cannot be...

Path traversal in Matrix Synapse

Impact Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory. The last two directories and file name of the path are chosen randomly by Synapse and cannot be...

CVE-2021-41281

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. T...

CVE-2021-41281

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. T...

Authentication flaw

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. T...

PYSEC-2021-436

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. T...

CVE-2021-41281

CVE-2021-41281 affects Synapse (Matrix homeserver) versions before 1.47.1 with the media repository enabled. A path traversal vulnerability lets an attacker cause a remote file to be downloaded into an arbitrary directory without authentication; the impact is mitigated by the last two path compon...

CVE-2021-41281

Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. T...

Airangel Hsmx Gateway Remote Code Execution Vulnerability

Airangel Hsmx Gateway is a platform from Airangel UK, Inc. It is used to manage authentication and billing in the network.A remote code execution vulnerability exists in Airangel Hsmx Gateway prior to 5.2.04, which originates when a remote server controlled by an attacker downloads and runs a...

Concrete CMS: open redirect to a remote website which can phish users

By Adding some extra headers in the request I noticed that the user is redirected to a remote website. This can lead to stealing a user credentials phishing on a remote server. These headers can be added either using a MITM attack or by chaining with another vulnerability such as request smugglin...

squid: denial of service in HTTP response processing

An input validation flaw was found in Squid. This issue could allow a remote server to perform a denial of service against all clients using the proxy when delivering HTTP response messages. The highest threat from this vulnerability is to system availability...

squid: denial of service in HTTP response processing

An input validation flaw was found in Squid. This issue could allow a remote server to perform a denial of service against all clients using the proxy when delivering HTTP response messages. The highest threat from this vulnerability is to system availability...

openSUSE 15 Security Update : apache2 (openSUSE-SU-2021:1438-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1438-1 advisory. - Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier...

Directory traversal

Revisor Video Management System VMS before 2.0.0 has a directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of restricted directory on the remote server. This could lead to the disclosure of...

CVE-2021-42261

Revisor Video Management System VMS before 2.0.0 has a directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of restricted directory on the remote server. This could lead to the disclosure of...

CVE-2021-42261

CVE-2021-42261 affects Revisor Video Management System (VMS) prior to 2.0.0. The issue is a directory traversal vulnerability that could allow an attacker to access files/directories outside restricted paths on the remote server, leading to potential sensitive data disclosure. Public sources cons...

CVE-2021-41611

An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be pass...