CVE-2024-36046

creationtimestamp| type| source ---|---|--- 2025-02-27 23:25:45+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5821 2025-02-28 00:02:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114078577366616418 2025-02-28 01:08:09+00:00| seen| https://t.me/cvedetector/19097 2025-02-28...

CVE-2024-37566

creationtimestamp| type| source ---|---|--- 2025-02-27 23:25:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5819 2025-02-28 00:02:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114078577366616418 2025-02-28 01:08:08+00:00| seen| https://t.me/cvedetector/19095 2025-02-28...

CVE-2024-41340

creationtimestamp| type| source ---|---|--- 2025-02-27 21:35:43+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114078000233980303 2025-02-27 21:59:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lj6va2dqje2y 2025-02-27 23:26:53+00:00| seen| https://t.me/cvedetector/190...

CVE-2024-41339

creationtimestamp| type| source ---|---|--- 2025-02-27 21:35:43+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114078000233980303 2025-02-27 21:59:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lj6v7zuxbm27 2025-02-27 23:26:52+00:00| seen| https://t.me/cvedetector/190...

CVE-2025-27399

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" localized English string: "To logged-in users", users that are not yet approved can view the block reasons. Instance admins...

CVE-2025-27157

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...

CVE-2025-27399 Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" localized English string: "To logged-in users", users that are not yet approved can view the block reasons. Instance admins...

CVE-2025-27399 Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" localized English string: "To logged-in users", users that are not yet approved can view the block reasons. Instance admins...

CVE-2025-27399

Summary: Mastodon contains an access-control bug where, when domain blocks/reasons visibility is set to the English string “To logged-in users,” users not yet approved can view the block reasons. Affected versions: before 4.1.23, 4.2.16, and 4.3.4. Impact: instance admins who rely on private doma...

CVE-2025-27399 Mastodon's domain blocks & rationales ignore user approval when visibility set as "users"

Mastodon is a self-hosted, federated microblogging platform. In versions prior to 4.1.23, 4.2.16, and 4.3.4, when the visibility for domain blocks/reasons is set to "users" localized English string: "To logged-in users", users that are not yet approved can view the block reasons. Instance admins...

CVE-2025-27157 Mastodon's rate-limits are missing on `/auth/setup`

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...

CVE-2025-27157 Mastodon's rate-limits are missing on `/auth/setup`

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...

CVE-2025-27157

Mastodon rate-limits are missing on /auth/setup in versions 4.2.0–4.2.15 and 4.3.0–4.3.3, enabling an attacker to craft requests that send emails to arbitrary addresses. The issue is fixed in 4.2.16 and 4.3.4. This CVE description documents the affected versions and the remediation. If exploiting...

CVE-2025-27157 Mastodon's rate-limits are missing on `/auth/setup`

Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on /auth/setup. Without those rate limits, an attacker can craft requests that will send an email to an arbitrary addresses. Versions 4.2.16 a...

CVE-2024-9334

creationtimestamp| type| source ---|---|--- 2025-02-27 15:23:56+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114076538403107122 2025-02-27 15:48:32+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114076635029385494 2025-02-27 16:45:05+00:00| seen|...

CVE-2025-1717

creationtimestamp| type| source ---|---|--- 2025-02-27 09:48:19+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114075218651181708 2025-02-27 10:22:16+00:00| seen| https://t.me/cvedetector/19026 2025-02-27 11:00:55+00:00| seen|...

CVE-2025-1282

creationtimestamp| type| source ---|---|--- 2025-02-27 08:26:41+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5658 2025-02-27 11:00:55+00:00| seen| Telegram/u5U5HkdsjVTNTjKDjqO60RM8YSduevD2fdfzdqTTMF2XVOk 2025-02-27 11:48:30+00:00| seen|...

Mastodon 安全漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A security vulnerability exists in Mastodon that stems from a lack of rate limiting in /auth/setup, which could result in sending emails to arbitrary addresses...

Mastodon 授权问题漏洞

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. An authorization issue vulnerability exists in Mastodon that stems from an unapproved user being able to view the reason for a domain block, affecting instance administrators who do not wish to make...

CVE-2025-25517

creationtimestamp| type| source ---|---|--- 2025-02-26 01:13:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lj276afptc2v 2025-02-26 01:44:43+00:00| seen| https://t.me/cvedetector/18929 2025-02-26 19:49:10+00:00| seen|...