Matrix-org vulnerabilities
85 CVEs and advisories name Matrix-org as an affected vendor, newest first. Follow it as a feed.
- CVE-2022-39202IRC mode parameter confusion in matrix-appservice-irc
- CVE-2022-39200Signature checks not applied to some retrieved missing events
- CVE-2022-31152Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules
- CVE-2022-36009Incorrect parsing of access level in gomatrixserverlib and dendrite
- CVE-2022-31052URL previews can crash Synapse media repositories or Synapse monoliths
- CVE-2022-29166Improper handling of multiline messages in matrix-appservice-irc
- CVE-2021-41281Path traversal in Matrix Synapse
- CVE-2021-39164Improper authorisation of /members discloses room membership to non-members
- CVE-2021-39163Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
- CVE-2021-32659Automatic room upgrade handling can be used maliciously to bridge a room non-consentually
- CVE-2021-32622File upload local preview can run embedded scripts after user interaction
- CVE-2021-29471Denial of service in Matrix Synapse
- CVE-2021-29431SSRF in Sydent due to missing validation of hostnames
- CVE-2021-29432Malicious users could control the content of invitation emails
- CVE-2021-29430Denial of service attack via memory exhaustion
- CVE-2021-29433Denial of service (via resource exhaustion) due to improper input validation
- CVE-2021-21392Open redirect via transitional IPv6 addresses on dual-stack networks
- CVE-2021-21393Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
- CVE-2021-21394Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
- CVE-2021-21333HTML injection in email and account expiry notifications
- CVE-2021-21332Cross-site scripting (XSS) vulnerability in the password reset endpoint
- CVE-2021-21320User content sandbox can be confused into opening arbitrary documents
- CVE-2021-21273Open redirects on some federation and push requests
- CVE-2021-21274Denial of service attack via .well-known lookups
- CVE-2020-26257Denial of service attack via incorrect parameters to federation APIs