matrix-org

Records116All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high42CVSS 7.0–8.9

Exploited now

matrix-org records in CISA KEV

No matrix-org vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Synapse 40 records MEDIUM Javascript Sdk 10 records MEDIUM Matrix Irc Bridge 7 records MEDIUM Sydent 7 records HIGH Olm 5 records MEDIUM Software Development Kit 4 records MEDIUM Dendrite 2 records MEDIUM Element 2 records MEDIUM

Records

10 records in Javascript Sdk · all components

TI-2022-18627 CVE-2022-39251 · GHSA-r48r-j8fx-mq2c

Matrix Javascript SDK vulnerable to Olm/Megolm protocol confusion

MEDIUM 46

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01176 Published 2022-09-28 Partial fix · 19.7.0 CWE-287

TI-2022-18626 CVE-2022-39250 · GHSA-5w8r-8pgj-5jmf

Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verification

MEDIUM 46

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01186 Published 2022-09-29 Partial fix · 19.7.0 CWE-287

TI-2021-20136 CVE-2021-44538 · GHSA-q7f4-j236-f4hc

The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer…

MEDIUM 46

The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02001 Published 2021-12-14 No fix listed CWE-119

TI-2023-12971 CVE-2023-28427 · GHSA-mwq8-fjpf-c2gr

Prototype pollution in matrix-js-sdk

MEDIUM 44

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01185 Published 2023-03-28 Partial fix · 24.0.0 CWE-1321

TI-2022-16482 CVE-2022-36059 · GHSA-rfv9-x7hh-xc32

Prototype pollution in matrix-js-sdk

MEDIUM 43

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00932 Published 2023-03-28 Partial fix · 19.4.0 CWE-1321

TI-2022-18625 CVE-2022-39249 · GHSA-6263-x97c-c4gg

Matrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessions

MEDIUM 41

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01276 Published 2022-09-28 Partial fix · 19.7.0 CWE-287

TI-2021-17748 CVE-2021-40823 · GHSA-23cm-x6j7-6hq3

A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix…

LOW 28

A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00662 Published 2021-09-13 Fixed in 12.4.1 CWE-290

TI-2022-18613 CVE-2022-39236 · GHSA-hvv8-5v86-r45x

Matrix Javascript SDK improper beacon events can cause availability issues

LOW 27

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01361 Published 2022-09-28 Partial fix · 19.7.0 CWE-20

TI-2024-28355 CVE-2024-42369 · GHSA-vhr5-g3pm-49fm

A room with itself as a its predecessor will freeze matrix-js-sdk

LOW 25

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00483 Published 2024-08-20 Fixed in 34.3.1 CWE-674

TI-2023-13897 CVE-2023-29529 · GHSA-6g67-q39g-r79q

matrix-js-sdk vulnerable to invisible eavesdropping in group calls

LOW 25

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00543 Published 2023-04-14 Fixed in 24.1.0 CWE-862

Open these records in search →

Critical	8
High	42
Medium	57
Low	9
No CVSS	0