CVE-2024-52590

Misskey is an open source, federated social media platform. In affected versions missing validation in "ApRequestService.signedGet" allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to...

CVE-2024-52590 Missing validation allows spoofed profiles in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to...

CVE-2024-52590 Missing validation allows spoofed profiles in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to...

CVE-2024-52591

Misskey is an open source, federated social media platform. In affected versions missing validation in "ApRequestService.signedGet" and "HttpRequestService.getActivityJson" allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different...

CVE-2024-52591 Missing validation allows spoofed profiles and notes in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet and HttpRequestService.getActivityJson allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance...

CVE-2024-52591

CVE-2024-52591 affects Misskey, where missing validation in ApRequestService.signedGet and HttpRequestService.getActivityJson allows forging of user profiles and notes across instances. The attack can impersonate both users and federated peers, with forged objects accepted as valid and full inter...

CVE-2024-52591 Missing validation allows spoofed profiles and notes in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet and HttpRequestService.getActivityJson allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance...

CVE-2024-52591 Missing validation allows spoofed profiles and notes in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet and HttpRequestService.getActivityJson allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance...

CVE-2024-52592

Misskey is an open source, federated social media platform. In affected versions missing validation in "ApInboxService.update" allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote...

CVE-2024-52592 Missing validation allows spoofed poll updates in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApInboxService.update allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instanc...

CVE-2024-52592

CVE-2024-52592 – Misskey : Misskey versions prior to 2024.11.0-alpha.3 suffer from missing validation in the ApInboxService.update function, allowing an attacker to modify poll results belonging to another user without authentication beyond a valid signature from any actor on any remote instance....

CVE-2024-52592 Missing validation allows spoofed poll updates in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApInboxService.update allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instanc...

CVE-2024-52592 Missing validation allows spoofed poll updates in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApInboxService.update allows an attacker to modify the result of polls belonging to another user. No authentication is required, except for a valid signature from any actor on any remote instanc...

CVE-2024-52593 Missing validation allows spoofed "origin" links in Misskey

Misskey is an open source, federated social media platform.In affected versions missing validation in NoteCreateService.insertNote, ApPersonService.createPerson, and ApPersonService.updatePerson allows an attacker to control the target of any "origin" links such as the "view on remote instance"...

CVE-2024-52593

Misskey is an open source, federated social media platform.In affected versions missing validation in "NoteCreateService.insertNote", "ApPersonService.createPerson", and "ApPersonService.updatePerson" allows an attacker to control the target of any "origin" links such as the "view on remote...

CVE-2024-52593 Missing validation allows spoofed "origin" links in Misskey

Misskey is an open source, federated social media platform.In affected versions missing validation in NoteCreateService.insertNote, ApPersonService.createPerson, and ApPersonService.updatePerson allows an attacker to control the target of any "origin" links such as the "view on remote instance"...

CVE-2024-52593

Misskey (open source, federated social platform) has a vulnerability from missing validation in NoteCreateService.insertNote, ApPersonService.createPerson, and ApPersonService.updatePerson. An attacker can set the target of any origin links (e.g., the “view on remote instance” banner) to any HTTP...

CVE-2024-52593 Missing validation allows spoofed "origin" links in Misskey

Misskey is an open source, federated social media platform.In affected versions missing validation in NoteCreateService.insertNote, ApPersonService.createPerson, and ApPersonService.updatePerson allows an attacker to control the target of any "origin" links such as the "view on remote instance"...

CVE-2024-52591: Improper Input Validation

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet and HttpRequestService.getActivityJson allows an attacker to create fake user profiles and forged notes. The spoofed users will appear to be from a different instance...

CVE-2024-52590: Improper Input Validation

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to...