Advisories · Technology
misskey.
Every CVE that names misskey among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.7 High
Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
- misskey
- CWE-459
- CVSS 8.7 High
Misskey: Lack of rate limiting and size restrictions in RSS fetching API
- misskey
- Denial of service
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Misskey: Cross-site scripting in RSS feed item links
- misskey
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation
- misskey
- Denial of service
- CVSS 8.9 High
Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks
- misskey
- Race condition
- CVSS 9.2 CriticalCritical · CVSS 9+
Misskey: JSON-LD signature validation + compaction may lead to improper activity handling
- misskey
- Weak cryptography or TLS
- CVSS 2.3 Low
Misskey: Lack of proper permission checks in Direct Messaging feature
- misskey
- Broken access control
- CVSS 6.3 Medium
Misskey: Improper Authorization in the Announcements API
- misskey
- Broken access control
- CVSS 7.4 High
Misskey: TOTP tokens can be reused
- misskey
- Authentication bypass
- CVSS 6.9 Medium
Misskey: SSRF bypass in URL Preview
- misskey
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Misskey lacks resource ownership validation
- misskey
- Broken access control
- CVSS 7.1 High
HTTP signature verification can be bypassed
- misskey
- Weak cryptography or TLS
- CVSS 9.2 CriticalCritical · CVSS 9+
Misskey lacks proper authorization checks and input validation
- misskey
- Broken access control
- CVSS 5.4 Medium
Misskey Directory Traversal Vulnerability in AiScript via `Mk:api`
- misskey
- Path traversal
- CVSS 7.2 High
Misskey CSS Style Injection Vulnerability In `MkUrlPreview`
- misskey
- CWE-20
- CWE-116
- CVSS 9.3 CriticalCritical · CVSS 9+
Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes
- misskey
- CWE-346
- CWE-441
- CVSS 8.2 High
Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes
- misskey
- Cross-site request forgery (CSRF)
- CWE-614
- CVSS 8.1 High
Misskey allows token to remain valid in cookie after signing out
- misskey
- Authentication bypass
- CVSS 7.4 High
Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey
- misskey
- Denial of service
- CWE-405
- CVSS 6.4 Medium
Server-Side Request Forgery vulnerability in various APIs in Misskey
- misskey
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 8.8 High
Missing validation allows spoofed profiles in Misskey
- misskey
- CWE-20
- CVSS 8.8 High
Missing validation allows spoofed profiles and notes in Misskey
- misskey
- CWE-20
- CVSS 6.9 Medium
Missing validation allows spoofed poll updates in Misskey
- misskey
- CWE-20
- CVSS 5.1 Medium
Missing validation allows spoofed "origin" links in Misskey
- misskey
- CWE-20
- CVSS 8.2 High
Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities
- misskey
- Broken access control
- CVSS 7.1 High
Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts
- misskey
- Unrestricted file upload
- CVSS 9.1 CriticalCritical · CVSS 9+
Misskey vulnerable to improper authorization when accessing with third-party application
- misskey
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Misskey's missing signature validation allows arbitrary users to impersonate any remote user.
- misskey
- Weak cryptography or TLS
- CVSS 7.5 High
Misskey allows users to bypass authentication of Bull dashboard
- misskey
- Authentication bypass
- CVSS 7.1 High
Cross site scripting (XSS) vulnerability using authentication callback in Misskey
- misskey
- Cross-site scripting (XSS)
- CVSS 7.1 High
Cross site scripting (XSS) vulnerability using url preview in Misskey
- misskey
- Cross-site scripting (XSS)
- CVSS 8.8 High
SQL injection of notes/search-by-tag
- misskey
- SQL injection
- CVSS 7.1 High
Cross site scripting (XSS) of ActivityPub URI in misskey
- misskey
- Cross-site scripting (XSS)
- CVSS 7.7 High
Server-Side Request Forgery vulnerability in misskey
- misskey
- Server-side request forgery (SSRF)
- CVSS 8.0 High
XSS vulnerability using dialog
- misskey
- Cross-site scripting (XSS)
-
Misskey before 10.102.4 allows hijacking a user's token.
- Misskey