CVE-2023-43793

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds...

New Phishing Emails Pretend to Offer Jobs to Steal Facebook Logins

Sublime Security warns of a massive credential phishing scam using fake job offers from brands like KFC and Red Bull to steal Facebook login details. Don't fall for the trap...

EUVD-2023-48168

Malicious code in bioql PyPI...

EUVD-2024-52057

Malicious code in bioql PyPI...

EUVD-2023-33028

Malicious code in bioql PyPI...

Malicious code in red-bull-venue-tools (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5fe5829b1fbc9d863be9bad876998565a13ebc95fecc9ccc5600f92ecd423b package.json declares preinstall=node index.js, which fires automatically ...

MAL-2025-5455 Malicious code in red-bull-venue-tools (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5fe5829b1fbc9d863be9bad876998565a13ebc95fecc9ccc5600f92ecd423b package.json declares preinstall=node index.js, which fires automatically ...

CVE-2025-24897

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...

CVE-2025-24896: Insufficient Session Expiration

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named token is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary...

CVE-2025-24897: Cross-Site Request Forgery (CSRF)

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be...

CVE-2025-24900: Cross-Site Request Forgery (CSRF)

Concorde, formerly know as Nexkey, is a fork of the federated microblogging platform Misskey. Due to a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, there is a vulnerability that allows MediaProxy authentication to be bypassed. In versions prior to...

PT-2025-6250 · Concorde · Concorde

Name of the Vulnerable Software and Affected Versions: Concorde versions prior to 12.25Q1.1 Description: The issue arises from a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, allowing an attacker to bypass MediaProxy authentication. This enables the...

PT-2025-6244

Name of the Vulnerable Software and Affected Versions: Misskey versions 12.109.0 through 2025.2.0-alpha.0 Description: Misskey is an open source, federated social media platform. Due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's...

PT-2025-6243 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions 12.109.0 through 2025.2.0-alpha.0 Description: Misskey is an open source, federated social media platform. A login token named token is stored in a cookie for authentication purposes in Bull Dashboard, but this remains...

CVE-2023-43793

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds...

CVE-2023-43793 Misskey allows users to bypass authentication of Bull dashboard

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds...

CVE-2023-43793 Misskey allows users to bypass authentication of Bull dashboard

Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds...

CVE-2023-43793

Misskey before version 2023.9.0 is vulnerable: by editing the URL, an attacker can bypass authentication for the Bull dashboard (the job queue UI) and access it. The Red Hat, NVD, OSV, and other connected sources consistently describe this as an authentication bypass affecting Misskey prior to 20...

PT-2023-28985 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 2023.9.0 Description: Misskey is an open source, decentralized social media platform. A user can bypass the authentication of the Bull dashboard, which is the job queue management UI, by editing the URL. This allows...

Misskey Authorization Issues Vulnerabilities

Misskey is a suite of micro-blogging platforms. An authorization issue vulnerability exists in versions of Misskey prior to 2023.9.0 that stems from the ability to bypass authentication in the Bull dashboard...