Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
367 results · page 2 of 8
Sep 11, 2025matrix-sdk-base is the base component to build a Matrix client library.CVE-2025-59047 · Other software · matrix-org · reported by GitHubLow 2.7
matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the `RoomMember::normalized_power_level()` method can cause a panic if a room member has a power level of `Int::Min`. The issue is fixed in matrix-sdk-base 0.14.1. The affected method isn’t used internally, so avoiding calling `RoomMember::normalized_power_level()` prevents the panic.
- Product
- matrix-rust-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2025A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality.CVE-2025-50688 · Other software · Twistedmatrix · reported by MITREMedium 6.5
A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality. An attacker can exploit this vulnerability by sending a specially crafted HTTP PUT request to upload a malicious file (e.g., a reverse shell script). Once uploaded, the attacker can trigger the execution of arbitrary commands on the target system, allowing for remote code execution. This could lead to escalation of privileges depending on the privileges of the web server process. The attack does not require physical access and can be conducted remotely, posing a significant risk to the confidentiality and integrity of the system.
- Product
- Twistedweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2025WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute CVE-2025-7920 · Other software · Simopro Technology · reported by twcert@cert.org.twMedium 6.1
WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
- Product
- WinMatrix3 Web package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 21, 2025WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commCVE-2025-7919 · Other software · Simopro Technology · reported by twcert@cert.org.twHigh 7.1
WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- Product
- WinMatrix3 Web package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 21, 2025WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commCVE-2025-7918 · Other software · Simopro Technology · reported by twcert@cert.org.twCritical 9.3
WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
- Product
- WinMatrix3 Web package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 21, 2025WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upCVE-2025-7917 · Other software · Simopro Technology · reported by twcert@cert.org.twHigh 8.6
WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
- Product
- WinMatrix3 Web package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 21, 2025WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code onCVE-2025-7916 · Other software · Simopro Technology · reported by twcert@cert.org.twCritical 9.3
WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized contents.
- Product
- WinMatrix3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Jul 10, 2025The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust.CVE-2025-53549 · Other software · matrix-org · reported by GitHubMedium 5.2
The Matrix Rust SDK is a collection of libraries that make it easier to build Matrix clients in Rust. An SQL injection vulnerability in the EventCache::find_event_with_relations method of matrix-sdk 0.11 and 0.12 allows malicious room members to execute arbitrary SQL commands in Matrix clients that directly pass relation types provided by those room members into this method, when used with the default sqlite-based store backend. Exploitation is unlikely, as no known clients currently use the API in this manner. This vulnerability is fixed in 0.13.
- Product
- matrix-rust-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2025Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry SysCVE-2025-6030 · Other software · Autoeastern · reported by cve@asrg.ioCritical 9.4
Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack. Research was completed on the 2024 KIA Soluto. Attack confirmed on other KIA Models in Ecuador.
- Product
- Cyclone Matrix TRF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordasrg.iorevers3everything.com
Jun 10, 2025matrix-rust-sdk is an implementation of a Matrix client-server library in Rust.CVE-2025-48937 · Other software · matrix-org · reported by GitHubMedium 4.9
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those events appear to the recipient as if they were sent by another user. This vulnerability is fixed in 0.11.1 and 0.12.0.
- Product
- matrix-rust-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025The component listed above contains a vulnerability that can be exploited by an attacker to perform a SQL Injection attack.CVE-2025-3751 · Other software · TIBCO Software Inc · reported by security@tibco.comHigh 7
The component listed above contains a vulnerability that can be exploited by an attacker to perform a SQL Injection attack. This could lead to unauthorised access to the database and exposure of sensitive information
- Product
- TIBCO ActiveMatrix BusinessWorks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of tCVE-2025-2261 · Other software · TIBCO Software Inc · reported by security@tibco.comHigh 7
Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within user's browser under the privileges of the web application.
- Product
- TIBCO BPM Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2025ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpassword.aspx.CVE-2025-29529 · Other software · reported by MITREMedium 6.5
ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpassword.aspx.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2025Element X Android is a Matrix Android Client provided by element.io.CVE-2025-27599 · Other software · element-hq · reported by GitHubMedium 6.5
Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.
- Product
- element-x-android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2025Element Web is a Matrix web client built using the Matrix React SDK.CVE-2025-32026 · Other software · element-hq · reported by GitHubLow 3.8
Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem.
- Product
- element-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Element X Android is a Matrix Android Client provided by element.io.CVE-2025-31127 · Other software · element-hq · reported by GitHubMedium 5.3
Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.4.
- Product
- element-x-android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2025Element X iOS is a Matrix iOS Client provided by Element.CVE-2025-31126 · Other software · element-hq · reported by GitHubMedium 5.3
Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8.
- Product
- element-x-ios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2025Synapse is an open source Matrix homeserver implementation.CVE-2025-30355 · Other software · element-hq · reported by GitHubHigh 7.1
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed in Synapse v1.127.1. No known workarounds are available.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025Element Android is an Android Matrix Client provided by Element.CVE-2025-27606 · Other software · element-hq · reported by GitHubMedium 5.1
Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.6.34 solves the issue.
- Product
- element-android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos.CVE-2025-27155 · Other software · matrix-org · reported by GitHubMedium 6.1
Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) included in Pinecone up to commit ea4c337 is vulnerable to stored cross-site scripting. The payload storage is not permanent and will be wiped when restarting pineconesim.
- Product
- pinecone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2025matrix-appservice-irc is a Node.js IRC bridge for Matrix.CVE-2025-27146 · Other software · matrix-org · reported by GitHubLow 2.7
matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbitrary IRC command execution as the puppeted user. The attacker can only inject commands executed as their own IRC user. The vulnerability has been patched in matrix-appservice-irc version 3.0.4.
- Product
- matrix-appservice-irc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when a specially crafteCVE-2024-53310 · Other software · reported by MITREMedium 5.5
A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when a specially crafted file is passed to the -ff parameter. The vulnerability occurs due to improper handling of file input with overly long characters, leading to memory corruption. This can result in arbitrary code execution or denial of service.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2025A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string is passed to the "-CVE-2024-53309 · Other software · reported by MITREMedium 5.5
A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string is passed to the "-f" parameter. This can lead to memory corruption, potentially allowing arbitrary code execution or causing a denial of service via specially crafted input.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXCVE-2024-51547 · Other software · ABB · reported by cybersecurity@ch.abb.comCritical 9.3
Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more.CVE-2025-23197 · Other software · matrix-org · reported by GitHubMedium 6.5
matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5 version 5.4.1 or below, is configured with GitHub support, it is vulnerable to a Denial of Service (DoS) whereby it can crash on restart due to a missing check. The impact is greater to you untrusted users can add their own GitHub organizations to Hookshot in order to connect their room to a repository. This vulnerability is fixed in 6.0.2 and 5.4.2.
- Product
- matrix-hookshot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025Mjolnir is a moderation tool for Matrix.CVE-2025-24024 · Other software · matrix-org · reported by GitHubCritical 9.1
Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature that introduced the bug, and version 1.9.2 reintroduces the feature safely. Downgrading to version 1.8.3 is recommended if upgrading to 1.9.1 or higher isn't possible.
- Product
- mjolnir
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-56515 · Other software · t2bot · reported by GitHubMedium 6.8
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-52791 · Other software · t2bot · reported by GitHubMedium 5.3
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part of normal operation, and these resource owners can return large amounts of JSON back to MMR for parsing. In parsing, MMR can consume large amounts of memory and exhaust available memory. This is fixed in MMR v1.3.8. Users are advised to upgrade. For users unable to upgrade; forward proxies can be configured to block requests to unsafe hosts. Alternatively, MMR processes can be configured with memory limits and auto-restart. Running multiple MMR processes concurrently can help ensure a restart does not overly impact users.
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-52602 · Other software · t2bot · reported by GitHubMedium 5
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade.
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-36403 · Other software · t2bot · reported by GitHubMedium 5.3
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 is vulnerable to unbounded disk consumption, where an unauthenticated adversary can induce it to download and cache large amounts of remote media files. MMR's typical operating environment uses S3-like storage as a backend, with file-backed store as an alternative option. Instances using a file-backed store or those which self-host an S3 storage system are therefore vulnerable to a disk fill attack. Once the disk is full, authenticated users will be unable to upload new media, resulting in denial of service. For instances configured to use a cloud-based S3 storage option, this could result in high service fees instead of a denial of service. MMR 1.3.5 introduces a new default-on "leaky bucket" rate limit to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data. Operators should note that the leaky bucket implementation introduced in MMR 1.3.5 requires the IP address associated with the request to be forwarded, to avoid mistakenly applying the
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.wikipedia.orggithub.com
Jan 16, 2025Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix.CVE-2024-36402 · Other software · t2bot · reported by GitHubMedium 5.3
Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround.
- Product
- matrix-media-repo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Gomatrixserverlib is a Go library for matrix federation.CVE-2024-52594 · Other software · matrix-org · reported by GitHubMedium 4.3
Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.
- Product
- gomatrixserverlib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025matrix-rust-sdk is an implementation of a Matrix client-server library in Rust.CVE-2024-52813 · Other software · matrix-org · reported by GitHubMedium 4.3
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified to an unverified one, which could cause client applications relying on the SDK to overlook such changes. matrix-sdk-crypto 0.8.0 adds a new VerificationLevel::VerificationViolation enum variant which indicates that a previously verified identity has been changed.
- Product
- matrix-rust-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-53867 · Other software · element-hq · reported by GitHubMedium 4.3
Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-53863 · Other software · element-hq · reported by GitHubHigh 8.2
Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing. This significantly expands the attack surface in a historically vulnerable area, presenting a risk that far outweighs the benefit, particularly since these formats are rarely used on the open web or within the Matrix ecosystem. Synapse 1.120.1 addresses the issue by restricting thumbnail generation to images in the following widely used formats: PNG, JPEG, GIF, and WebP. This vulnerability is fixed in 1.120.1.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-52815 · Other software · element-hq · reported by GitHubHigh 8.7
Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such invalid invites received over federation and restores the ability to sync for affected users.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-52805 · Other software · element-hq · reported by GitHubHigh 8.2
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by denying requests with unsupported multipart/form-data content type.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-37303 · Other software · element-hq · reported by GitHubMedium 5.3
Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2024Synapse is an open-source Matrix homeserver.CVE-2024-37302 · Other software · element-hq · reported by GitHubHigh 7.5
Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of service, ranging from further media uploads/downloads failing to completely unavailability of the Synapse process, depending on how Synapse was deployed. Synapse 1.106 introduces a new "leaky bucket" rate limit on remote media downloads to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data to be cached.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2024matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol.CVE-2024-52505 · Other software · matrix-org · reported by GitHubMedium 5.4
matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in matrix-appservice-irc version 3.0.3.
- Product
- matrix-appservice-irc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Element is a Matrix web client built using the Matrix React SDK.CVE-2024-51750 · Other software · element-hq · reported by GitHubMedium 5
Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in Element Web and Desktop 1.11.85.
- Product
- element-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Element is a Matrix web client built using the Matrix React SDK.CVE-2024-51749 · Other software · element-hq · reported by GitHubLow 3.5
Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85.
- Product
- element-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.CVE-2024-50336 · Other software · matrix-org · reported by GitHubMedium 5.3
matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1.
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comspec.matrix.org
Oct 29, 2024Exam Matrix: Incorrect Privilege AssignmentCVE-2024-50485 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in Udit Rawat Exam Matrix exam-matrix allows Privilege Escalation.This issue affects Exam Matrix: from n/a through <= 1.5.
- Product
- Exam Matrix
- Affected
- up to 1.5
- What to do
- Affects up to 1.5. Update Exam Matrix to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 25, 2024This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface.CVE-2024-10381 · Other software · Matrix Comsec · reported by vdisclose@cert-in.org.inCritical 9.3
This vulnerability exists in Matrix Door Controller Cosec Vega FAXQ due to improper implementation of session management at the web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the vulnerable device. Successful exploitation of this vulnerability could allow remote attacker to gain unauthorized access and take complete control of the targeted device.
- Product
- Matrix Door Controller Cosec Vega FAXQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page.CVE-2024-47824 · Other software · matrix-org · reported by GitHubHigh 8.7
matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 and before 3.102.0, matrix-react-sdk allows a malicious homeserver to potentially steal message keys for a room when a user invites another user to that room, via injection of a malicious device controlled by the homeserver. This is possible because matrix-react-sdk before 3.102.0 shared historical message keys on invite. Version 3.102.0 fixes this issue by disabling sharing message keys on invite by removing calls to the vulnerable functionality. No known workarounds are available.
- Product
- matrix-react-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Element is a Matrix web client built using the Matrix React SDK.CVE-2024-47779 · Other software · element-hq · reported by GitHubHigh 7
Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Note that despite superficial similarity to CVE-2024-47771, this is an entirely separate vulnerability, caused by a separate piece of code included only in Element Web. Element Web and Element Desktop share most but not all, of their code and this vulnerability exists in the part of the code base which is not shared between the projects. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
- Product
- element-web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Element Desktop is a Matrix client for desktop platforms.CVE-2024-47771 · Other software · element-hq · reported by GitHubHigh 7
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
- Product
- element-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript.CVE-2024-47080 · Other software · matrix-org · reported by GitHubHigh 8.7
matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method `MatrixClient.sendSharedHistoryKeys` is vulnerable to interception by malicious homeservers. The method was introduced by MSC3061) and is commonly used to share historical message keys with newly invited users, granting them access to past messages in the room. However, it unconditionally sends these "shared" keys to all of the invited user's devices, regardless of whether the user's cryptographic identity is verified or whether the user's devices are signed by that identity. This allows the attacker to potentially inject its own devices to receive sensitive historical keys without proper security checks. Note that this only affects clients running the SDK with the legacy crypto stack. Clients using the new Rust cryptography stack (i.e. those that call `MatrixClient.initRustCrypto()` instead of `MatrixClient.initCrypto()`) are unaffected by this vulnerability, because `MatrixClient.sendSharedHistoryKeys()` raises an exception in such environments. The vulnerability was fixed in matrix-js-sdk 34.8.0 by removing the vulnerable functionalit
- Product
- matrix-js-sdk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024An issue was discovered in Matrix libolm through 3.2.16.CVE-2024-45193 · Other software · matrix · reported by MITREMedium 4.3
An issue was discovered in Matrix libolm through 3.2.16. There is Ed25519 signature malleability due to lack of validation criteria (does not ensure that S < n). This refers to the libolm implementation of Olm. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- olm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.matrix.orggitlab.matrix.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.