Vulnerabilidades

Absolute File Traversal vulnerabilities allows access and modification of un-intended resources. Affected products:

Dangerous File Upload vulnerabilities allow upload of malicious scripts. Affected products:

Credentials Disclosure vulnerabilities allow access to on board project back-up bundles. Affected products:

Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list functions. Affected products:

Service Control vulnerabilities allow access to service restart requests and vm configuration settings. Affected products:

Information Disclosure vulnerabilities allow access to application configuration information. Affected products:

Configuration Download vulnerabilities allow access to dependency configuration information. Affected products:

Local File Inclusion vulnerabilities allow access to sensitive system information. Affected products:

MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application dependency calculates or validates MD5 checksum hashes. Affected products:

Cross Site Request Forgery vulnerabilities where found providing a potiential for exposing sensitive information or changing system settings. Affected products:

Weak Password Reset Rules vulnerabilities where found providing a potiential for the storage of weak passwords that could facilitate unauthorized admin/application access. Affected products:

Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products:

Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products:

Unauthorized Access vulnerabilities allow Remote Code Execution. Affected products:

Improper Input Validation vulnerability allows Remote Code Execution. Affected products:

Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products:

Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products:

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for processing. This…

Synapse is an open-source Matrix homeserver. Synapse versions before 1.120.1 fail to properly validate invites received over federation. This vulnerability allows a malicious server to send a specially crafted invite that disrupts the invited user's /sync functionality. Synapse 1.120.1 rejects such invalid invites…

Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial of service attacks. Synapse 1.120.1 resolves the issue by…

Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in…

Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insufficient to mitigate this. This can lead to a denial of…

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. The provisioning API of the matrix-appservice-irc bridge up to version 3.0.2 contains a vulnerability which can lead to arbitrary IRC command execution as the bridge IRC bot. The vulnerability has been patched in matrix-appservice-irc…

Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in Element Web and Desktop 1.11.85.

Element is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85.