Advisories · Technology
element-hq element-web.
Every CVE that names element-hq element-web among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters
- element-hq element-web
- element-hq element-desktop
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Element Web: A malicious homeserver can inject HTML in Element Web using its homepage
- element-hq element-web
- Cross-site scripting (XSS)
- CVSS 2.7 Low
In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left
- element-hq element-web
- CWE-20
- CVSS 3.8 Low
Element Web could load a malicious instance of Element Call leaking media encryption keys
- element-hq element-web
- Information disclosure
- CVSS 5.0 Medium
Element allows a malicious homeserver can modify events leading to unrenderable events or rooms
- element-hq element-web
- CWE-248
- CVSS 3.5 Low
Element's thumbnails can be abused to misrepresent the content of an attachment
- element-hq element-web
- CWE-451
- CVSS 7.0 High
Element Web vulnerable to potential exposure of access token via authenticated media
- element-hq element-web
- Information disclosure