https://db.gcve.eu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 22 Jul 2026 23:28:24 +0000 https://db.gcve.eu/sighting/38302ed5-ccab-4cdd-91da-6e5e1ad5059d/export {"uuid": "38302ed5-ccab-4cdd-91da-6e5e1ad5059d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26258", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/1866", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2020-26258\n\ud83d\udd39 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.\n\ud83d\udccf Published: 2020-12-16T01:05:22\n\ud83d\udccf Modified: 2025-01-15T20:20:17.971Z\n\ud83d\udd17 References:\n1. https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28\n2. https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E\n3. https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html\n4. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP\n5. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7\n6. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB\n7. https://security.netapp.com/advisory/ntap-20210409-0005\n8. https://www.debian.org/security/2021/dsa-4828\n9. https://x-stream.github.io/CVE-2020-26258.html", "creation_timestamp": "2025-01-15T20:55:06.000000Z"} {"uuid": "38302ed5-ccab-4cdd-91da-6e5e1ad5059d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26258", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/1866", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2020-26258\n\ud83d\udd39 Description: XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.\n\ud83d\udccf Published: 2020-12-16T01:05:22\n\ud83d\udccf Modified: 2025-01-15T20:20:17.971Z\n\ud83d\udd17 References:\n1. https://github.com/x-stream/xstream/security/advisories/GHSA-4cch-wxpw-8p28\n2. https://lists.apache.org/thread.html/r97993e3d78e1f5389b7b172ba9f308440830ce5f051ee62714a0aa34@%3Ccommits.struts.apache.org%3E\n3. https://lists.debian.org/debian-lts-announce/2020/12/msg00042.html\n4. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22KVR6B5IZP3BGQ3HPWIO2FWWCKT3DHP\n5. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVPHZA7VW2RRSDCOIPP2W6O5ND254TU7\n6. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QGXIU3YDPG6OGTDHMBLAFN7BPBERXREB\n7. https://security.netapp.com/advisory/ntap-20210409-0005\n8. https://www.debian.org/security/2021/dsa-4828\n9. https://x-stream.github.io/CVE-2020-26258.html", "creation_timestamp": "2025-01-15T20:55:06.000000Z"} https://db.gcve.eu/sighting/38302ed5-ccab-4cdd-91da-6e5e1ad5059d/export Wed, 15 Jan 2025 20:55:06 +0000 https://db.gcve.eu/sighting/63fc2fd9-e140-41e6-b62f-73a5eb330277/export {"uuid": "63fc2fd9-e140-41e6-b62f-73a5eb330277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26259", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2917", "content": "#Threat_Research\nDocumented Vulnerabilities in XStream + Workarounds\n(PoCs for CVE-2021-21341-21351, CVE-2020-26217, CVE-2020-26258, CVE-2020-26259, CVE-2017-7957, CVE-2016-3674, CVE-2013-7285)\nhttp://x-stream.github.io/security.html", "creation_timestamp": "2021-03-16T11:01:03.000000Z"} {"uuid": "63fc2fd9-e140-41e6-b62f-73a5eb330277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26259", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2917", "content": "#Threat_Research\nDocumented Vulnerabilities in XStream + Workarounds\n(PoCs for CVE-2021-21341-21351, CVE-2020-26217, CVE-2020-26258, CVE-2020-26259, CVE-2017-7957, CVE-2016-3674, CVE-2013-7285)\nhttp://x-stream.github.io/security.html", "creation_timestamp": "2021-03-16T11:01:03.000000Z"} https://db.gcve.eu/sighting/63fc2fd9-e140-41e6-b62f-73a5eb330277/export Tue, 16 Mar 2021 11:01:03 +0000 https://db.gcve.eu/sighting/ef58ad89-f263-4d14-9389-ff6d68638a74/export {"uuid": "ef58ad89-f263-4d14-9389-ff6d68638a74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26258", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2917", "content": "#Threat_Research\nDocumented Vulnerabilities in XStream + Workarounds\n(PoCs for CVE-2021-21341-21351, CVE-2020-26217, CVE-2020-26258, CVE-2020-26259, CVE-2017-7957, CVE-2016-3674, CVE-2013-7285)\nhttp://x-stream.github.io/security.html", "creation_timestamp": "2021-03-16T11:01:03.000000Z"} {"uuid": "ef58ad89-f263-4d14-9389-ff6d68638a74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26258", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2917", "content": "#Threat_Research\nDocumented Vulnerabilities in XStream + Workarounds\n(PoCs for CVE-2021-21341-21351, CVE-2020-26217, CVE-2020-26258, CVE-2020-26259, CVE-2017-7957, CVE-2016-3674, CVE-2013-7285)\nhttp://x-stream.github.io/security.html", "creation_timestamp": "2021-03-16T11:01:03.000000Z"} https://db.gcve.eu/sighting/ef58ad89-f263-4d14-9389-ff6d68638a74/export Tue, 16 Mar 2021 11:01:03 +0000 https://db.gcve.eu/sighting/12c071e6-d392-4f1b-b1ce-40efd878331a/export {"uuid": "12c071e6-d392-4f1b-b1ce-40efd878331a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26252", "type": "seen", "source": "https://t.me/cibsecurity/22471", "content": "\u203c CVE-2020-26252 \u203c\n\nOpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-21T00:27:51.000000Z"} {"uuid": "12c071e6-d392-4f1b-b1ce-40efd878331a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26252", "type": "seen", "source": "https://t.me/cibsecurity/22471", "content": "\u203c CVE-2020-26252 \u203c\n\nOpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-01-21T00:27:51.000000Z"} https://db.gcve.eu/sighting/12c071e6-d392-4f1b-b1ce-40efd878331a/export Thu, 21 Jan 2021 00:27:51 +0000 https://db.gcve.eu/sighting/4abd0ea1-811b-4603-a9d5-fe094b8bfd2d/export {"uuid": "4abd0ea1-811b-4603-a9d5-fe094b8bfd2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26251", "type": "seen", "source": "https://t.me/cibsecurity/21083", "content": "\u203c CVE-2020-26251 \u203c\n\nOpen Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they're not explicitly added to the trusted allowlist.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-18T20:44:02.000000Z"} {"uuid": "4abd0ea1-811b-4603-a9d5-fe094b8bfd2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26251", "type": "seen", "source": "https://t.me/cibsecurity/21083", "content": "\u203c CVE-2020-26251 \u203c\n\nOpen Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case management. In Open Zaak before version 1.3.3 the Cross-Origin-Resource-Sharing policy in Open Zaak is currently wide open - every client is allowed. This allows evil.com to run scripts that perform AJAX calls to known Open Zaak installations, and the browser will not block these. This was intended to only apply to development machines running on localhost/127.0.0.1. Open Zaak 1.3.3 disables CORS by default, while it can be opted-in through environment variables. The vulnerability does not actually seem exploitable because: a) The session cookie has a `Same-Site: Lax` policy which prevents it from being sent along in Cross-Origin requests. b) All pages that give access to (production) data are login-protected c) `Access-Control-Allow-Credentials` is set to `false` d) CSRF checks probably block the remote origin, since they're not explicitly added to the trusted allowlist.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-18T20:44:02.000000Z"} https://db.gcve.eu/sighting/4abd0ea1-811b-4603-a9d5-fe094b8bfd2d/export Fri, 18 Dec 2020 20:44:02 +0000 https://db.gcve.eu/sighting/8f4f1c52-ee49-4504-830d-5ce6bcbb8f35/export {"uuid": "8f4f1c52-ee49-4504-830d-5ce6bcbb8f35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26259", "type": "seen", "source": "https://t.me/cibsecurity/20907", "content": "\u203c CVE-2020-26259 \u203c\n\nXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-16T15:25:36.000000Z"} {"uuid": "8f4f1c52-ee49-4504-830d-5ce6bcbb8f35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26259", "type": "seen", "source": "https://t.me/cibsecurity/20907", "content": "\u203c CVE-2020-26259 \u203c\n\nXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-16T15:25:36.000000Z"} https://db.gcve.eu/sighting/8f4f1c52-ee49-4504-830d-5ce6bcbb8f35/export Wed, 16 Dec 2020 15:25:36 +0000 https://db.gcve.eu/sighting/e65d5a69-fa3f-4e0f-bb29-0d8b816af8bc/export {"uuid": "e65d5a69-fa3f-4e0f-bb29-0d8b816af8bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26258", "type": "seen", "source": "https://t.me/cibsecurity/20905", "content": "\u203c CVE-2020-26258 \u203c\n\nXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-16T15:25:24.000000Z"} {"uuid": "e65d5a69-fa3f-4e0f-bb29-0d8b816af8bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26258", "type": "seen", "source": "https://t.me/cibsecurity/20905", "content": "\u203c CVE-2020-26258 \u203c\n\nXStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-16T15:25:24.000000Z"} https://db.gcve.eu/sighting/e65d5a69-fa3f-4e0f-bb29-0d8b816af8bc/export Wed, 16 Dec 2020 15:25:24 +0000 https://db.gcve.eu/sighting/16bf090b-c5ed-4655-8ad8-f682a387d2fc/export {"uuid": "16bf090b-c5ed-4655-8ad8-f682a387d2fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26257", "type": "seen", "source": "https://t.me/cibsecurity/18371", "content": "\u203c CVE-2020-26257 \u203c\n\nMatrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference \"homeserver\" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-10T02:25:09.000000Z"} {"uuid": "16bf090b-c5ed-4655-8ad8-f682a387d2fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26257", "type": "seen", "source": "https://t.me/cibsecurity/18371", "content": "\u203c CVE-2020-26257 \u203c\n\nMatrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference \"homeserver\" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-10T02:25:09.000000Z"} https://db.gcve.eu/sighting/16bf090b-c5ed-4655-8ad8-f682a387d2fc/export Thu, 10 Dec 2020 02:25:09 +0000 https://db.gcve.eu/sighting/ada2a02e-6f28-44b6-96a9-e4125d903acd/export {"uuid": "ada2a02e-6f28-44b6-96a9-e4125d903acd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26257", "type": "seen", "source": "https://t.me/cibsecurity/18351", "content": "\u203c CVE-2020-26257 \u203c\n\nMatrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference \"homeserver\" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-10T01:25:19.000000Z"} {"uuid": "ada2a02e-6f28-44b6-96a9-e4125d903acd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26257", "type": "seen", "source": "https://t.me/cibsecurity/18351", "content": "\u203c CVE-2020-26257 \u203c\n\nMatrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference \"homeserver\" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-10T01:25:19.000000Z"} https://db.gcve.eu/sighting/ada2a02e-6f28-44b6-96a9-e4125d903acd/export Thu, 10 Dec 2020 01:25:19 +0000 https://db.gcve.eu/sighting/69eb30e7-2d57-493d-8744-1916682d484f/export {"uuid": "69eb30e7-2d57-493d-8744-1916682d484f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26257", "type": "seen", "source": "https://t.me/cibsecurity/18331", "content": "\u203c CVE-2020-26257 \u203c\n\nMatrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference \"homeserver\" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-10T01:22:55.000000Z"} {"uuid": "69eb30e7-2d57-493d-8744-1916682d484f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2020-26257", "type": "seen", "source": "https://t.me/cibsecurity/18331", "content": "\u203c CVE-2020-26257 \u203c\n\nMatrix is an ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference \"homeserver\" implementation of Matrix. A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request. This can lead to a denial of service in which future events will not be correctly sent to other servers over federation. This affects any server which accepts federation requests from untrusted servers. The Matrix Synapse reference implementation before version 1.23.1 the implementation is vulnerable to this injection attack. Issue is fixed in version 1.23.1. As a workaround homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-10T01:22:55.000000Z"} https://db.gcve.eu/sighting/69eb30e7-2d57-493d-8744-1916682d484f/export Thu, 10 Dec 2020 01:22:55 +0000