1. Home
  2. Common Vulnerabilities and Exposures
  3. Matrix Synapse APIs prone to attack

Matrix Synapse APIs prone to attack

Overview :
Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs.
Affected Product(s) :
  • Matrix Synapse before 1.5.0
Vulnerability Details :
CVE ID : CVE-2019-18835
  Events sent over /send_join, /send_leave, and /invite may not be correctly signed, or may not come from the expected servers.

Solution :

Update to Matrix Synapse 1.5.0

 

Common Vulnerabilityies and Exposures

HejHome GKW-IC052 hard-coded credentials [CVE-2021-26611]

A vulnerability, which was classified as critical, has been found in HejHome GKW-IC052 (affected version not known). Affected by this issue is an unknown part. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Learn more

BaserCMS ZIP File path traversal [CVE-2021-41279]

A vulnerability, which was classified as critical, was found in BaserCMS (Content Management System) (the affected version unknown). This affects an unknown code of the component ZIP File Handler. Upgrading eliminates this vulnerability. Applying the patch d8ab0a81a7bce35cc95ff7dff851a7e87a084336 is able to eliminate this problem. The bugfix is ready for download at […]

Learn more

Bandisoft ARK Library Ark_NormalizeAndDupPAthNameW path value integer overflow

A vulnerability has been found in Bandisoft ARK Library (Software Library) (the affected version is unknown) and classified as critical. This vulnerability affects the function Ark_NormalizeAndDupPAthNameW. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Learn more