Vulnerabilidades em matrix-org

83 resultados
Análise Vexday

O ecossistema matrix-org acumula 80 CVEs catalogadas, com 2 classificadas como críticas e nenhuma atualmente registrada no catálogo CISA KEV, posicionando o vendor abaixo da média geral de exploração ativa do catálogo. A ausência de provas de conceito públicas e de novos registros nos últimos 90 dias sugere um ritmo de descoberta baixo no período recente, embora o histórico acumulado mereça acompanhamento contínuo. A falha mais prevalente é do tipo CWE-287 (falhas de autenticação), o que indica uma área estrutural de risco que equipes de segurança devem priorizar em revisões de configuração e controle de acesso. A CVE mais perigosa ativa no momento é CVE-2020-26257, com score EPSS de 0,0236, sinalizando probabilidade de exploração relativamente baixa, mas que não deve ser descartada em ambientes que ainda não aplicaram as correções correspondentes.

CVE-2022-39251HIGHMatrix Javascript SDK vulnerable to Olm/Megolm protocol confusionEPSS 0.9%CVE-2022-39374MEDIUMSynapse Denial of service due to incorrect application of event authorization rules during state resolutionEPSS 0.9%CVE-2022-36059HIGHPrototype pollution in matrix-js-sdkEPSS 0.9%CVE-2022-31152MEDIUMSynapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rulesEPSS 0.9%CVE-2021-32659MEDIUMAutomatic room upgrade handling can be used maliciously to bridge a room non-consentuallyEPSS 0.9%CVE-2021-29432MEDIUMMalicious users could control the content of invitation emailsEPSS 0.9%CVE-2021-29433MEDIUMDenial of service (via resource exhaustion) due to improper input validationEPSS 0.9%CVE-2021-21320LOWUser content sandbox can be confused into opening arbitrary documentsEPSS 0.9%CVE-2022-36060HIGHPrototype pollution in matrix-react-sdkEPSS 0.9%CVE-2023-43796MEDIUMSynapse vulnerable to leak of remote user device informationEPSS 0.9%CVE-2021-39163LOWAdding a private/unlisted room to a community exposes room metadata in an unauthorised manner.EPSS 0.9%CVE-2021-21392MEDIUMOpen redirect via transitional IPv6 addresses on dual-stack networksEPSS 0.9%CVE-2023-38690MEDIUMmatrix-appservice-irc IRC command injection via admin commands containing newlines EPSS 0.9%CVE-2024-50336MEDIUMmatrix-js-sdk has insufficient MXC URI validation which allows client-side path traversalEPSS 0.8%CVE-2022-41952MEDIUMUncontrolled Resource Consumption in Matrix Synapse EPSS 0.8%CVE-2022-39248HIGHmatrix-android-sdk2 vulnerable to Olm/Megolm protocol confusionEPSS 0.8%CVE-2022-39257HIGHMatrix iOS SDK vulnerable to impersonation via forwarded Megolm sessionsEPSS 0.8%CVE-2022-39255HIGHMatrix iOS SDK vulnerable ton Olm/Megolm protocol confusionEPSS 0.8%CVE-2023-32682MEDIUMImproper checks for deactivated users during login in synapseEPSS 0.8%CVE-2022-39203HIGHParsing issue in matrix-org/node-irc leading to room takeoversEPSS 0.7%