312 matches found
CVE-2021-39169
Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...
Cross site scripting
Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...
CVE-2021-39169
Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...
CVE-2021-39169 XSS vulnerability using dialog
Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-in dialog to display a malicious string, leading to cross-site scripting XSS. XSS could compromise the API request token. This issue has been fixed in version...
CVE-2021-39169
CVE-2021-39169 affects Misskey prior to version 12.51.0. The vulnerability is a cross-site scripting (XSS) flaw where the web client’s built-in dialog can display a malicious string, potentially compromising the API request token. A fix exists in version 12.51.0; upgrading is the recommended reme...
Misskey 跨站脚本漏洞
Misskey is a micro-blogging platform. A cross-site scripting vulnerability exists in versions of Misskey prior to 12.51.0, which stems from a built-in dialog box in the Web client that does not validate and escape user input. An attacker could display a malicious string in the dialog box and use ...
Misskey Cross-Site Scripting Vulnerability
Misskey is a micro-blogging platform. A cross-site scripting vulnerability exists in versions of Misskey prior to 10.102.4 that can be exploited by an attacker to hijack user tokens...
CVE-2019-1020010
Misskey before 10.102.4 allows hijacking a user's token...
CVE-2019-1020010
Misskey before 10.102.4 allows hijacking a user's token...
Code injection
Misskey before 10.102.4 allows hijacking a user's token...
CVE-2019-1020010
Misskey before 10.102.4 is affected by a vulnerability that allows hijacking a user’s token. Technical sources describe this as a cross‑site scripting flaw affecting Misskey versions prior to 10.102.4, with token theft as the impact. Mitigation: upgrade to 10.102.4 or later. The CVE entry itself ...