Malicious code in steep_mastodon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6d173f5b238b8f2ba94de217745a32ec2d76138364f4d72e82876d2f8ef0d57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-49461

Malicious code in ridiculousmastodonz3n npm...

BIT-MASTODON-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon

Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0...

GHSA-QW9X-CQR3-WC7R

creationtimestamp| type| source ---|---|--- 2025-11-05 14:59:52+00:00| seen| https://mstdn.social/users/jschauma/statuses/115497683553103053 2025-11-06 20:51:33+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115504728778207295...

CVE-2025-11563

creationtimestamp| type| source ---|---|--- 2025-11-04 07:44:19+00:00| seen| https://seclists.org/oss-sec/2025/q4/127 2025-11-04 08:43:16+00:00| seen| https://mastodon.social/users/bagder/statuses/115490540139486022 2025-11-04 08:43:29+00:00| seen|...

BIT-MASTODON-2025-62605 Mastodon quotes control can be bypassed

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0. Mastodon internally...

CVE-2025-62605

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon...

CVE-2025-62605

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon...

CVE-2025-62605 Mastodon quotes control can be bypassed

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon...

EUVD-2025-35213

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon...

CVE-2025-62605

Mastodon quotes control bypass vulnerability (CVE-2025-62605) affects 4.4.x and earlier 4.5.0-beta.2 where reblogging a post and quoting the reblog could display a preview of a post without authorization due to how reblogs are treated as statuses. Patches exist in 4.4.8 and 4.5.0-beta.2, which mi...

CVE-2025-62605 Mastodon quotes control can be bypassed

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon...

CVE-2025-62605 Mastodon quotes control can be bypassed

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon version 4.4, support for verifiable quote posts with quote controls was added, but it is possible for an attacker to bypass these controls in Mastodon versions prior to 4.4.8 and 4.5.0-beta.2. Mastodon...

CVE-2025-36088

creationtimestamp| type| source ---|---|--- 2025-10-21 06:28:38+00:00| seen| https://mastodon.social/users/deeg/statuses/115410738543603113...

Mastodon 代码问题漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A code issue vulnerability exists in Mastodon versions prior to 4.4.8 and prior to 4.5.0-beta.2, which stems from not properly handling reposting statuses and could lead to bypassing the reference...

PT-2025-42913

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.8 Mastodon versions 4.4.0 through 4.4.7 Mastodon versions prior to 4.5.0-beta.2 Description Mastodon is a free, open-source social network server based on ActivityPub. A flaw exists where an attacker can bypass...

GHSA-JQ43-27X9-3V86

creationtimestamp| type| source ---|---|--- 2025-10-15 16:53:27+00:00| seen| https://mastodon.social/users/chrisvest/statuses/115379221747646716...

CVE-2025-59419

creationtimestamp| type| source ---|---|--- 2025-10-15 14:36:33+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86 2025-10-15 16:53:27+00:00| seen| https://mastodon.social/users/chrisvest/statuses/115379221747646716 2025-10-22 00:05:07+00:00|...

BIT-MASTODON-2025-62176 Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels

Mastodon is a free, open-source social network server based on ActivityPub. In Mastodon before 4.4.6, 4.3.14, and 4.2.27, the streaming server accepts serving events for public timelines to clients using any valid authentication token, even if those tokens lack the read:statuses scope. This allow...

BIT-MASTODON-2025-62175 Mastodon streaming API fails to disconnect disabled and suspended users

Mastodon is a free, open-source social network server based on ActivityPub. In versions before 4.4.6, 4.3.14, and 4.2.27, disabling or suspending a user account does not disconnect the account from the streaming API. This allows disabled or suspended accounts to continue receiving real-time updat...