CVE-2023-25154 Cross site scripting (XSS) of ActivityPub URI in misskey

Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a user or note received through ActivityPub is not properly validated, so by inserting a URL with a javascript scheme an attacker may execut...

PT-2023-19794 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 13.3.1 Description: The issue arises from insufficient validation of the redirect URL during miauth authentication, allowing arbitrary JavaScript execution when a user allows the link. This can be exploited when user...

PT-2023-19795 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 13.3.2 Description: The issue concerns a cross-site scripting vulnerability due to insufficient URL validation in the URL preview function. This allows arbitrary JavaScript to be executed when a malicious URL is load...

PT-2023-19796 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 13.3.3 Description: Misskey is an open source, decentralized social media platform. SQL injection is possible due to insufficient parameter validation in the note search API by tag "notes/search-by-tag" endpoint. The...

Misskey 跨站脚本漏洞

Misskey is a suite of micro-blogging platforms. A security vulnerability exists in Misskey versions prior to 13.5.0 that stems from a lack of proper authentication and can be exploited by an attacker to execute arbitrary JavaScript code...

PT-2023-19942 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 13.5.0 Description: Misskey is an open source, decentralized social media platform. The link to the instance of the sender that appears when viewing a user or note received through ActivityPub is not properly validat...

Misskey 跨站脚本漏洞

Misskey is a set of micro-blogging platform. A cross-site scripting vulnerability exists in Misskey versions prior to 13.3.1, which stems from insufficient validation of redirect URLs and can be exploited by an attacker to execute arbitrary JavaScript...

Misskey SQL注入漏洞

Misskey is a micro blogging platform. A SQL injection vulnerability exists in Misskey versions prior to 13.3.3, which stems from insufficient validation of parameters, and may be subject to SQL injection...

Misskey 跨站脚本漏洞

Misskey is a set of micro-blogging platform. A cross-site scripting vulnerability exists in versions prior to Misskey 13.3.2, which stems from insufficient validation of URLs and a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary JavaScript...

Misskey code issue vulnerability

Misskey is a micro-blogging platform, and a code issue vulnerability exists in Misskey due to a server-side request forgery vulnerability in the software's "upload from URL" and remote attachment handling. This could lead to the disclosure of non-public information on the intranet. No details of...

CVE-2021-39195

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

CVE-2021-39195

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

CVE-2021-39195

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

Server side request forgery (ssrf)

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

CVE-2021-39195

CVE-2021-39195 affects Misskey, an open source decentralized microblogging platform, via a Server-Side Request Forgery in the Upload from URL and remote attachment handling. The vulnerability could lead to disclosure of non-public information within the internal network. Red Hat security pages (a...

CVE-2021-39195 Server-Side Request Forgery vulnerability in misskey

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been...

Misskey Cross-Site Scripting Vulnerability (CNVD-2021-66913)

Misskey is a micro-blogging platform. A cross-site scripting vulnerability exists in versions of Misskey prior to 12.51.0, which stems from a built-in dialog box in the Web client that does not validate and escape user input. An attacker could display a malicious string in the dialog box and use ...

CVE-2021-39169

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...

CVE-2021-39169

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...

Cross site scripting

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...