0.99.3

DATE	CVE	VULNERABILITY TITLE	RISK
2020-11-24	CVE-2020-26890	Improper Input Validation vulnerability in multiple products Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. network low complexity matrix fedoraproject CWE-20	7.5
2020-10-19	CVE-2020-26891	Cross-site Scripting vulnerability in Matrix Synapse AuthRestServlet in Matrix Synapse before 1.21.0 is vulnerable to XSS due to unsafe interpolation of the session GET parameter. network low complexity matrix CWE-79	6.1
2019-11-08	CVE-2019-18835	Insufficient Verification of Data Authenticity vulnerability in Matrix Synapse Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. network low complexity matrix CWE-345 critical	9.8
2019-05-09	CVE-2019-11842	Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Matrix Sydent and Synapse An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. network low complexity matrix CWE-338	7.5