CRITICAL9.1CVE-2024-53863Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders from 0, < 1.121.0-1
from 0, < 0.33.3.1-1
HIGH8.6Improper Verification of Cryptographic Signature in matrix-synapse
from 0, < 1.5.0-1
HIGH7.5Synapse allows unsupported content types to lead to memory exhaustion
from 0, < 1.121.0-1
HIGH7.5Synapse denial of service through media disk space consumption
from 0, < 1.116.0-1
HIGH7.5Denial of service due to incorrect application of event authorization rules
from 0, < 1.63.0-1
HIGH7.5matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG
from 0, < 0.99.2-5
HIGH7.5Matrix Synapse DoS
from 0, < 0.28.1+dfsg-1
HIGH7.5Matrix Synapse Authorization Error
from 0, < 0.31.2+dfsg-1
HIGH7.5Matrix Synapse Security Filtering Flaw
from 0, < 0.31.1+dfsg-1
HIGH7.5Matrix Synapse Predictable Secret Key
from 0, < 0.34.1.1-1
HIGH7.5Path traversal in Matrix Synapse
from 0, < 1.47.1-1
HIGH7.5Denial of service attack due to invalid JSON
from 0, < 1.20.0-1
HIGH7.1Synapse vulnerable to federation denial of service via malformed events
from 0, < 1.121.0-6
MEDIUM6.9Cross-site scripting (XSS) vulnerability in the password reset endpoint
from 0, < 1.27.0-1
MEDIUM6.5Synapse V2 state resolution weakness allows Denial of Service (DoS)
from 0, < 1.103.0-2
MEDIUM6.5Synapse Denial of service due to incorrect application of event authorization rules during state resolution
from 0, < 1.68.0-1
MEDIUM6.5URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths
from 0, < 1.61.1-1
MEDIUM6.5Denial of service attack via incorrect parameters in Matrix Synapse
from 0, < 1.24.0-1
MEDIUM6.3Open redirect via transitional IPv6 addresses on dual-stack networks
from 0, < 1.28.0-1
MEDIUM6.1HTML injection in email and account expiry notifications
from 0, < 1.27.0-1
MEDIUM6.1Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
from 0, < 1.21.1-1
MEDIUM5.5Synapse CPU starvation (Denial of Service)
from 0, < 1.152.1-1
MEDIUM5.4Synapse has improper checks for deactivated users during login
from 0, < 1.90.0-1
MEDIUM5.3Synapse allows a a malformed invite to break the invitee's `/sync`
from 0, < 1.121.0-1
MEDIUM5.3Synapse's unauthenticated writes to the media repository allow planting of problematic content
from 0, < 1.116.0-1
MEDIUM5.3Synapse vulnerable to leak of remote user device information
from 0, < 1.95.1-1
MEDIUM5.3Uncontrolled Resource Consumption in Matrix Synapse
from 0, < 1.53.0-1
MEDIUM5.3Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
from 0, < 1.28.0-1
MEDIUM5.3Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
from 0, < 1.28.0-1
MEDIUM5.0Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
from 0, < 1.74.0-1
MEDIUM5.0Synapse does not apply enough checks to servers requesting auth events of events in a room
from 0, < 1.69.0-1
MEDIUM4.9matrix-synapse vulnerable to denial of service due to malicious server ACL events
from 0, < 1.94.0-1
MEDIUM4.3Synapse Matrix has a partial room state leak via Sliding Sync
from 0, < 1.121.0-1
MEDIUM4.3Denial of service attack via .well-known lookups
from 0, < 1.25.0-1
LOW3.7matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes
from 0, < 1.93.0-1
LOW3.7Denial of service attack via push rule patterns in matrix-synapse
from 0, < 1.33.2-1
LOW3.5Synapse has URL deny list bypass via oEmbed and image URLs when generating previews
from 0, < 1.90.0-1
LOW3.1matrix-synapse vulnerable to improper validation of receipts allows forged read receipts
from 0, < 1.93.0-1
LOW3.1Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
from 0, < 1.41.1-1
LOW3.1Improper authorisation of members discloses room membership to non-members
from 0, < 1.41.1-1
LOW3.1Open redirects on some federation and push requests
from 0, < 1.25.0-1
LOW2.7Synapse pagination Denial of Service
from 0, < 1.152.1-1
—Synapse's invalid device keys degrade federation functionality
from 0, < 1.139.2-1