Vulnerabilities in matrix-org
85 resultsCVE-2020-26257MEDIUMDenial of service attack via incorrect parameters to federation APIsEPSS 2.4%CVE-2021-21274MEDIUMDenial of service attack via .well-known lookupsEPSS 2.2%CVE-2021-29430HIGHDenial of service attack via memory exhaustionEPSS 1.8%CVE-2021-21273LOWOpen redirects on some federation and push requestsEPSS 1.8%CVE-2022-31052MEDIUMURL previews can crash Synapse media repositories or Synapse monolithsEPSS 1.7%CVE-2021-29471LOWDenial of service in Matrix SynapseEPSS 1.6%CVE-2021-21393MEDIUMDenial of service (via resource exhaustion) due to improper input validation on groups/communities endpointsEPSS 1.6%CVE-2021-41281HIGHPath traversal in Matrix SynapseEPSS 1.6%CVE-2021-21394MEDIUMDenial of service (via resource exhaustion) due to improper input validation on third-party identifier endpointsEPSS 1.5%CVE-2021-39164LOWImproper authorisation of /members discloses room membership to non-membersEPSS 1.5%CVE-2023-45129MEDIUMmatrix-synapse vulnerable to denial of service due to malicious server ACL eventsEPSS 1.4%CVE-2022-39236MEDIUMMatrix Javascript SDK improper beacon events can cause availability issuesEPSS 1.4%CVE-2021-21333MEDIUMHTML injection in email and account expiry notificationsEPSS 1.4%CVE-2022-39249HIGHMatrix Javascript SDK vulnerable to impersonation via forwarded Megolm sessionsEPSS 1.3%CVE-2021-21332MEDIUMCross-site scripting (XSS) vulnerability in the password reset endpointEPSS 1.2%CVE-2022-31152MEDIUMSynapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rulesEPSS 1.2%CVE-2023-43796MEDIUMSynapse vulnerable to leak of remote user device informationEPSS 1.2%CVE-2021-29431HIGHSSRF in Sydent due to missing validation of hostnamesEPSS 1.2%CVE-2022-39250HIGHMatrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationEPSS 1.2%CVE-2023-28427HIGHPrototype pollution in matrix-js-sdkEPSS 1.2%