Priority MEDIUM 56
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.
CVSS 3.1MEDIUM 5.0· Network · Low privileges · No interaction · EPSS 0.00981 · Published 2023-05-26 · Fixed in 1.74.0 CWE-20
Priority MEDIUM 44
Synapse is an open-source Matrix homeserver.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.0057 · Published 2024-12-03 · Fixed in 1.120.1 CWE-20
Priority MEDIUM 44
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00864 · Published 2019-11-07 · Fixed in 1.5.0 CWE-345
Priority MEDIUM 43
Synapse is an open-source Matrix homeserver.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00606 · Published 2024-12-03 · Fixed in 1.120.1 CWE-434
Priority MEDIUM 43
Synapse is an open-source Matrix homeserver.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00739 · Published 2024-12-03 · Fixed in 1.120.1 CWE-770
Priority MEDIUM 41
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01538 · Published 2018-09-18 · Fixed in 0.33.3.1, 0.33.2.1 CWE-347
Priority MEDIUM 40
Synapse is an open-source Matrix homeserver.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00596 · Published 2024-12-03 · Fixed in 1.106 CWE-770
Priority LOW 38
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).
CVSS 3.1HIGH 8.2· Network · No auth · User interaction · EPSS 0.01221 · Published 2021-03-26 · Fixed in 1.27.0 CWE-79
Priority LOW 38
Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federa…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03004 · Published 2020-11-24 · Fixed in 1.20.0 CWE-20
Priority LOW 38
Matrix Synapse before 0.34.0.1, when the macaroon_secret_key authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02485 · Published 2019-03-19 · Fixed in 0.34.0.1 CWE-330
Priority LOW 37
Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00937 · Published 2022-11-22 · Fixed in 1.53.0 CWE-400
Priority LOW 36
Synapse is a package for Matrix homeservers written in Python 3/Twisted.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01577 · Published 2021-11-23 · Fixed in 1.47.1 CWE-22
Priority LOW 36
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01795 · Published 2019-05-09 · Fixed in 1.0.3, 0.99.3.1 CWE-338
Priority LOW 36
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01811 · Published 2018-06-14 · Fixed in 0.31.2
Priority LOW 36
The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01792 · Published 2018-06-13 · Fixed in 0.31.1
Priority LOW 36
Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py, as exploite…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01494 · Published 2018-05-02 · Fixed in 0.28.1 CWE-20
Priority LOW 35
Synapse is an open source Matrix homeserver implementation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01226 · Published 2025-03-27 · Fixed in 1.127.1 CWE-20
Priority LOW 35
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01203 · Published 2022-09-02 · Fixed in 1.62.0, 1.62.0rc1 CWE-703
Priority LOW 33
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02164 · Published 2021-02-26 · Fixed in 1.25.0 CWE-400
Priority LOW 33
Matrix is an ecosystem for open federated Instant Messaging and VoIP.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02392 · Published 2020-12-09 · Fixed in 1.23.1 CWE-400
Priority LOW 32
Synapse is an open-source Matrix homeserver.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01463 · Published 2024-04-23 · Fixed in 1.105.1 CWE-770
Priority LOW 32
Synapse is an open source home server implementation for the Matrix chat network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0166 · Published 2022-06-28 · Fixed in 1.61.1 CWE-674
Priority LOW 32
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01538 · Published 2021-04-12 · Fixed in 1.28.0 CWE-20
Priority LOW 32
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01596 · Published 2021-04-12 · Fixed in 1.28.0 CWE-20
Priority LOW 31
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00941 · Published 2023-05-26 · Fixed in 1.68.0, 1.68.0rc1 CWE-400
Load more
THREATIST.IORead the docs