matrix-org synapse

• CVE-2023-43796 Medium 5.3 Synapse vulnerable to leak of remote user device information 1.2%
• CVE-2023-45129 Medium 4.9 matrix-synapse vulnerable to denial of service due to malicious server ACL events 1.4%
• CVE-2023-41335 Low 3.7 Temporary storage of plaintext passwords during password changes in matrix synapse 0.4%
• CVE-2023-42453 Low 3.1 Improper validation of receipts allows forged read receipts in matrix synapse 0.8%
• CVE-2023-32683 Low 3.5 URL deny list bypass via oEmbed and image URLs when generating previews in Synapse 0.6%
• CVE-2023-32682 Medium 5.4 Improper checks for deactivated users during login in synapse 0.8%
• CVE-2022-39374 Medium 6.5 Synapse Denial of service due to incorrect application of event authorization rules during state resolution 0.9%
• CVE-2022-39335 Medium 5.0 Synapse does not apply enough checks to servers requesting auth events of events in a room 0.6%
• CVE-2023-32323 Medium 5.0 Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites 1.0%
• CVE-2022-41952 Medium 6.5 Uncontrolled Resource Consumption in Matrix Synapse 0.9%
• CVE-2022-31152 Medium 6.4 Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rules 1.2%
• CVE-2022-31052 Medium 6.5 URL previews can crash Synapse media repositories or Synapse monoliths 1.7%
• CVE-2021-41281 High 7.5 Path traversal in Matrix Synapse 1.6%
• CVE-2021-39164 Low 3.1 Improper authorisation of /members discloses room membership to non-members 1.5%
• CVE-2021-39163 Low 3.1 Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. 0.9%
• CVE-2021-29471 Low 3.7 Denial of service in Matrix Synapse 1.6%
• CVE-2021-21392 Medium 6.3 Open redirect via transitional IPv6 addresses on dual-stack networks 0.9%
• CVE-2021-21393 Medium 5.3 Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints 1.6%
• CVE-2021-21394 Medium 5.3 Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints 1.5%
• CVE-2021-21333 Medium 6.1 HTML injection in email and account expiry notifications 1.4%
• CVE-2021-21332 Medium 6.9 Cross-site scripting (XSS) vulnerability in the password reset endpoint 1.2%
• CVE-2021-21273 Low 3.1 Open redirects on some federation and push requests 1.8%
• CVE-2021-21274 Medium 4.3 Denial of service attack via .well-known lookups 2.2%
• CVE-2020-26257 Medium 6.5 Denial of service attack via incorrect parameters to federation APIs 2.4%