CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38686 – Sydent does not verify email server certificates
https://notcve.org/view.php?id=CVE-2023-38686
Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle (MITM) attack. Attackers with privileged access to the network can intercept room invitations and address confirmation emails. This is patched in Sydent 2.5.6. • https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261 https://github.com/matrix-org/sydent/pull/574 https://github.com/matrix-org/sydent/releases/tag/v2.5.6 https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g https://github.com/python/cpython/issues/91826 https://peps.python.org/pep-0476 • CWE-295: Improper Certificate Validation •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2023-37259 – Cross site scripting in Export Chat feature
https://notcve.org/view.php?id=CVE-2023-37259
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored Cross site scripting (XSS). Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact. However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side. • https://github.com/matrix-org/matrix-react-sdk/commit/22fcd34c606f32129ebc967fc21f24fb708a98b8 https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-c9vx-2g7w-rp65 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3383 – SourceCodester Game Result Matrix System GET Parameter athlete-profile.php sql injection
https://notcve.org/view.php?id=CVE-2023-3383
A vulnerability, which was classified as critical, was found in SourceCodester Game Result Matrix System 1.0. This affects an unknown part of the file /dipam/athlete-profile.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/M9KJ-TEAM/CVEReport/blob/main/SQL2.md https://vuldb.com/?ctiid.232239 https://vuldb.com/?id.232239 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3382 – SourceCodester Game Result Matrix System GET Parameter save-delegates.php cross site scripting
https://notcve.org/view.php?id=CVE-2023-3382
A vulnerability, which was classified as problematic, has been found in SourceCodester Game Result Matrix System 1.0. Affected by this issue is some unknown functionality of the file /dipam/save-delegates.php of the component GET Parameter Handler. The manipulation of the argument del_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/M9KJ-TEAM/CVEReport/blob/main/XSS3.md https://vuldb.com/?ctiid.232238 https://vuldb.com/?id.232238 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32683 – URL deny list bypass via oEmbed and image URLs when generating previews in Synapse
https://notcve.org/view.php?id=CVE-2023-32683
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the `url_preview_url_blacklist` setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the `url_preview_ip_range_blacklist` setting (by default this only allows public IPs) and by the limited information returned to the client: 1. For discovered oEmbed URLs, any non-JSON response or a JSON response which includes non-oEmbed information is discarded. 2. For discovered image URLs, any non-image response is discarded. • https://github.com/matrix-org/synapse/pull/15601 https://github.com/matrix-org/synapse/security/advisories/GHSA-98px-6486-j7qc https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2 • CWE-863: Incorrect Authorization CWE-918: Server-Side Request Forgery (SSRF) •