1230 matches found
Mastodon 安全漏洞
Mastodon is an open source social network server based on ActivityPub. Mastodon suffers from a security vulnerability that stems from incorrect access control, as it does not compress incoming signed JSON-LD activities...
CVE-2022-0432
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0...
CVE-2022-0432
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0...
Code injection
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0...
CVE-2022-0432 Prototype Pollution in mastodon/mastodon
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0...
CVE-2022-0432
Mastodon prior to 3.5.0 is affected by a Prototype Pollution vulnerability. The issue arises in the Mastodon repository where untrusted data can pollute the prototype of built-in objects (as detailed in the Nuclei template and CVE entry for CVE-2022-0432). Impact notes indicate potential remote c...
CVE-2022-0432 Prototype Pollution in mastodon/mastodon
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0...
PT-2022-13181 · Mastodon · Mastodon
Name of the Vulnerable Software and Affected Versions: Mastodon versions prior to 3.5.0 Description: The issue is related to Prototype Pollution in the GitHub repository mastodon/mastodon. Recommendations: For versions prior to 3.5.0, update to version 3.5.0 or later to resolve the issue...
mastodon 安全漏洞
Mastodon is an open source social network server based on ActivityPub. A security vulnerability exists in mastodon, which stems from an attribute obfuscation security issue that can be exploited by an attacker to conduct a malicious attack using object attribute obfuscation...
in mastodon/mastodon
Description The message event listener in embed.js does not check the origin of postMessage before changing the height of the embedded toots. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input id and height to code and now attacker is able to...
Prototype Pollution in mastodon/mastodon
Description Javascript is "prototype" language which means when a new "object" is created, it carries the predefined properties and methods of an "object" with itself like toString, constructor etc. By using prototype-pollution vulnerability, an attacker can overwrite/create the property of that...
CVE-2021-23450
creationtimestamp| type| source ---|---|--- 2021-12-17 22:37:40+00:00| seen| https://t.me/cibsecurity/34227 2025-10-21 06:28:38+00:00| seen| https://mastodon.social/users/deeg/statuses/115410738543603113...
CVE-2021-21269
Keymaker is a Mastodon Community Finder based Matrix Community serverlist page Server. In Keymaker before version 0.2.0, the assets endpoint did not check for the extension. The rust join method without checking user input might have made it abe to do a Path Traversal attack causing to read more...
Path traversal
Keymaker is a Mastodon Community Finder based Matrix Community serverlist page Server. In Keymaker before version 0.2.0, the assets endpoint did not check for the extension. The rust join method without checking user input might have made it abe to do a Path Traversal attack causing to read more...
CVE-2021-21269 Path Traversal in Keymaker
Keymaker is a Mastodon Community Finder based Matrix Community serverlist page Server. In Keymaker before version 0.2.0, the assets endpoint did not check for the extension. The rust join method without checking user input might have made it abe to do a Path Traversal attack causing to read more...
CVE-2021-21269
CVE-2021-21269 affects Keymaker (a Mastodon Community Finder based Matrix serverlist page). Before v0.2.0, the assets endpoint did not validate the requested extension, and the Rust join call on user input allowed a Path Traversal, enabling reading of files beyond the intended directory. This cou...
ACCESS Act might improve data privacy through interoperability
Data privacy is back in Congressional lawmakers’ sights, as a new, legislative proposal focuses not on data collection, storage, and selling, but on the idea that Americans should be able to more easily pack up their user data and take it to a competing service—perhaps one that better respects...
CVE-2018-21018
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions...