CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30494
https://notcve.org/view.php?id=CVE-2021-30494
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations). Múltiples servicios del sistema instalados junto con el paquete de software Razer Synapse versión 3, llevan a cabo operaciones privilegiadas en las entradas dentro de la subclave Razer Chroma SDK. Estas operaciones privilegiadas consisten en la concatenación de nombres de archivo de un archivo de registro de tiempo de ejecución que es usado para almacenar información de registro de tiempo de ejecución. • https://versprite.com/advisories/razer-synapse-3-1 https://versprite.com/blog/security-research/razer-synapse-3-security-vulnerability-analysis-report https://versprite.com/security-resources • CWE-276: Incorrect Default Permissions •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30493
https://notcve.org/view.php?id=CVE-2021-30493
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other words, an attacker can create a file in an unintended directory (with some limitations). Múltiples servicios del sistema instalados junto con el paquete de software Razer Synapse versión 3, llevan a cabo operaciones privilegiadas en las entradas dentro de la subclave ChromaBroadcast. Estas operaciones privilegiadas consisten en la concatenación de nombres de archivo de un archivo de registro de tiempo de ejecución que es usado para almacenar información de registro de tiempo de ejecución. • https://versprite.com/advisories/razer-synapse-3-cve-2021-30493 https://versprite.com/blog/security-research/razer-synapse-3-security-vulnerability-analysis-report https://versprite.com/security-resources • CWE-276: Incorrect Default Permissions •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21392 – Open redirect via transitional IPv6 addresses on dual-stack networks
https://notcve.org/view.php?id=CVE-2021-21392
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks. • https://github.com/matrix-org/synapse/pull/9240 https://github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY https://pypi.org/project/matrix-synapse • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21393 – Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
https://notcve.org/view.php?id=CVE-2021-21393
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. • https://github.com/matrix-org/synapse/pull/9321 https://github.com/matrix-org/synapse/pull/9393 https://github.com/matrix-org/synapse/security/advisories/GHSA-jrh7-mhhx-6h88 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY https://pypi.org/project/matrix-synapse • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21394 – Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
https://notcve.org/view.php?id=CVE-2021-21394
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.28.0 Synapse is missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary. Not all clients might abide by them. • https://github.com/matrix-org/synapse/pull/9321 https://github.com/matrix-org/synapse/pull/9393 https://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY https://pypi.org/project/matrix-synapse • CWE-20: Improper Input Validation •