mastodon vulnerabilities (Bitnami)
52 vulnerabilities.
-
mastodonBitnami Mastodon: Unwanted deactivation of SSL/TLS certificate verification 7.4 High -
mastodonBitnami Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses 6.3 Medium -
mastodonBitnami Mastodon: Personally-identifying information disclosure due to incorrect access control validation 7.5 High -
mastodonBitnami Mastodon: Exhausting data by an unauthenticated request to the admin retention API 7.5 High -
mastodonBitnami Mastodon: Persistent anonymous DoS via unhandled NoMethodError in MATH_TRANSFORMER 7.5 High -
mastodonBitnami Mastodon: Spoofing of attribution domains 5.3 Medium -
mastodonBitnami Mastodon: Removal of integrity-protected JSON entries from signed activities 6.5 Medium -
mastodonBitnami Mastodon: SSRF protection bypass on older Ruby versions 8.6 High -
mastodonBitnami Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring 5.3 Medium -
mastodonBitnami Mastodon: SSRF Bypass via IPv6 Unspecified Address (::) 8.7 High -
mastodonBitnami Mastodon has a consent-check bypass in its remote Collections 7.5 High -
mastodonBitnami Mastodon: Insufficient verification of email addresses 8.2 High -
mastodonBitnami Mastodon has a denial of service for quote authorization 4.8 Medium -
mastodonBitnami Mastodon has a GET-Based Open Redirect via '/web/%2F<domain>' 4.3 Medium -
mastodonBitnami Mastodon has SSRF via unvalidated FASP Provider base_url 4.6 Medium -
mastodonBitnami Mastodon may allow unconfirmed FASP to make subscriptions 4.8 Medium -
mastodonBitnami Mastodon's signature-dependent ActivityPub collection responses cached under signature-independent keys (Web Cache Poisoning via `Rails.cache`) 6.5 Medium -
mastodonBitnami Mastodon has insufficient access control to push notification settings 6.5 Medium -
mastodonBitnami Mastodon missing length limits on list names, filter names, and filter keywords 4.3 Medium -
mastodonBitnami Mastodon vulnerable to Denial of Service from a single post (client/server) 7.5 High -
mastodonBitnami Mastodon may allow a remote suspension bypass 5.3 Medium -
mastodonBitnami Local Mastodon users can enumerate and access severed relationships of every other local user 6.5 Medium -
mastodonBitnami Mastodon has SSRF Protection bypass 7.1 High -
mastodonBitnami Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration 3.7 Low -
mastodonBitnami Mastodon quotes control can be bypassed 4.3 Medium -
mastodonBitnami Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channels 4.3 Medium -
mastodonBitnami Mastodon streaming API fails to disconnect disabled and suspended users 4.3 Medium -
mastodonBitnami Mastodon allows continued access after password reset via CLI 3.5 Low -
mastodonBitnami Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails 5.3 Medium -
mastodonBitnami Mastodon's domain blocks & rationales ignore user approval when visibility set as "users" 5.3 Medium -
mastodonBitnami Mastodon's rate-limits are missing on `/auth/setup` 5.3 Medium -
mastodonBitnami Mastodon 4.1.x before 4.1.17 and 4.2.x before 4.2.9 allows a bypass of rate limiting via a crafted HTTP request header. 7.5 High -
mastodonBitnami In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request... 5.9 Medium -
mastodonBitnami Mastodon has improper authorship check on audience extension for existing posts 8.2 High -
mastodonBitnami Lack of media type verification of Activity Streams objects allows impersonation of remote accounts 8.5 High -
mastodonBitnami Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon 3.1 Low -
mastodonBitnami External OpenID Connect Account Takeover by E-Mail Change in mastodon 4.2 Medium -
mastodonBitnami Mastodon Remote user impersonation and takeover 9.4 Critical -
mastodonBitnami Mastodon vulnerable to Stored XSS through the translation feature 6.1 Medium -
mastodonBitnami Mastodon Invalid Domain Name Normalization vulnerability 7.4 High -
mastodonBitnami Mastodon Server-Side Request Forgery vulnerability 5.4 Medium -
mastodonBitnami Mastodon's verified profile links can be formatted in a misleading way 5.4 Medium -
mastodonBitnami Mastodon vulnerable to Denial of Service through slow HTTP responses 7.5 High -
mastodonBitnami Mastodon vulnerable to arbitrary file creation through media attachments 10.0 Critical -
mastodonBitnami Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards 9.3 Critical -
mastodonBitnami Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database 7.7 High -
mastodonBitnami The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon... 4.3 Medium -
mastodonBitnami Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue)... 7.5 High -
mastodonBitnami Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon 9.8 Critical -
mastodonBitnami app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions. 5.3 Medium - Show olderLoading…