Skip to contentMatrix-org vulnerabilities
Newest
- matrix javascript sdk, matrix-org matrix-js-sdk +1 moreMatrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationCVE-2022-39250Fix available8.6 High
- matrix-org matrix-ios-sdk, matrix software development kit +1 moreMatrix iOS SDK vulnerable to impersonation via forwarded Megolm sessionsCVE-2022-392577.5 High
- matrix-org matrix-ios-sdk, matrix software development kit +1 moreMatrix iOS SDK vulnerable ton Olm/Megolm protocol confusionCVE-2022-392558.6 High
- matrix-org matrix-android-sdk2, matrix software development kit +1 morematrix-android-sdk2 vulnerable to Olm/Megolm protocol confusionCVE-2022-39248Fix available8.6 High
- matrix-org matrix-android-sdk2, matrix software development kit +1 morematrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessionsCVE-2022-39246Fix available7.5 High
- matrix javascript sdk, matrix-org matrix-js-sdk +1 moreMatrix Javascript SDK vulnerable to Olm/Megolm protocol confusionCVE-2022-39251Fix available8.6 High
- matrix javascript sdk, matrix-org matrix-js-sdk +1 moreMatrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsCVE-2022-39249Fix available7.5 High
- matrix javascript sdk, matrix-org matrix-js-sdk +1 moreMatrix Javascript SDK improper beacon events can cause availability issuesCVE-2022-39236Fix available4.3 Medium
- matrix irc bridge, matrix-org matrix-appservice-irc +1 moreParsing issue in matrix-org/node-irc leading to room takeoversCVE-2022-39203Fix available8.8 High
- matrix irc bridge, matrix-org matrix-appservice-irc +1 moreIRC mode parameter confusion in matrix-appservice-ircCVE-2022-39202Fix available4.3 Medium
- matrix dendriteSignature checks not applied to some retrieved missing eventsCVE-2022-39200Fix available7.3 High
- matrix-org matrix-js-sdk, matrix javascript sdk +1 morePrototype pollution in matrix-js-sdkCVE-2022-36059Fix available8.2 High
- element-hq synapseSynapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rulesCVE-2022-31152Fix available6.4 Medium
- matrix dendrite, gomatrixserverlib +1 moreIncorrect parsing of access level in gomatrixserverlib and dendriteCVE-2022-36009Fix available5.0 Medium
- element-hq synapse, fedoraproject fedora +1 moreURL previews can crash Synapse media repositories or Synapse monolithsCVE-2022-31052Fix available6.5 Medium
- matrix irc bridge, matrix-org matrix-appservice-irc +1 moreImproper handling of multiline messages in matrix-appservice-ircCVE-2022-29166Fix available8.0 High
- element-hq synapseUncontrolled Resource Consumption in Matrix SynapseCVE-2022-41952Fix available6.5 Medium
- element-hq synapse, fedoraproject fedora +1 morePath traversal in Matrix SynapseCVE-2021-41281Fix available7.5 High
- element-hq synapse, fedoraproject fedora +1 moreImproper authorisation of /members discloses room membership to non-membersCVE-2021-39164Fix available3.1 Low
- element-hq synapse, fedoraproject fedora +1 moreAdding a private/unlisted room to a community exposes room metadata in an unauthorised manner.CVE-2021-39163Fix available3.1 Low
- matrix matrix-appservice-bridgeAutomatic room upgrade handling can be used maliciously to bridge a room non-consentuallyCVE-2021-32659Fix available6.5 Medium
- matrix-org matrix-react-sdkFile upload local preview can run embedded scripts after user interactionCVE-2021-32622Fix available4.2 Medium
- element-hq synapse, fedoraproject fedora +1 moreDenial of service in Matrix SynapseCVE-2021-29471Fix available3.7 Low
- matrix sydentSSRF in Sydent due to missing validation of hostnamesCVE-2021-29431Fix available7.7 High
- matrix sydentMalicious users could control the content of invitation emailsCVE-2021-29432Fix available5.3 Medium
- matrix sydentDenial of service attack via memory exhaustionCVE-2021-29430Fix available7.5 High
- matrix sydentDenial of service (via resource exhaustion) due to improper input validationCVE-2021-29433Fix available4.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreOpen redirect via transitional IPv6 addresses on dual-stack networksCVE-2021-21392Fix available6.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsCVE-2021-21393Fix available5.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreDenial of service (via resource exhaustion) due to improper input validation on third-party identifier endpointsCVE-2021-21394Fix available5.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreHTML injection in email and account expiry notificationsCVE-2021-21333Fix available6.1 Medium
- element-hq synapse, fedoraproject fedora +1 moreCross-site scripting (XSS) vulnerability in the password reset endpointCVE-2021-21332Fix available6.9 Medium
- matrix-org matrix-react-sdkUser content sandbox can be confused into opening arbitrary documentsCVE-2021-21320Fix available2.6 Low
- element-hq synapse, fedoraproject fedora +1 moreOpen redirects on some federation and push requestsCVE-2021-21273Fix available3.1 Low
- element-hq synapse, fedoraproject fedora +1 moreDenial of service attack via .well-known lookupsCVE-2021-21274Fix available4.3 Medium
- element-hq synapse, fedoraproject fedora +1 moreDenial of service attack via incorrect parameters to federation APIsCVE-2020-26257Fix available6.5 Medium