Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
joinmastodon mastodon vulnerabilities and exploits
(subscribe to this query)
9.9
CVSSv3
CVE-2023-36460
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any loca...
Joinmastodon Mastodon
1 Article
9.8
CVSSv3
CVE-2024-23832
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version before 3....
Joinmastodon Mastodon
1 Article
9.8
CVSSv3
CVE-2022-2166
Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon before 4.0.0.
Joinmastodon Mastodon 4.0.0
Joinmastodon Mastodon
9.8
CVSSv3
CVE-2022-24307
Mastodon prior to 3.3.2 and 3.4.x prior to 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)
Joinmastodon Mastodon
9.8
CVSSv3
CVE-2018-21018
Mastodon prior to 2.6.3 mishandles timeouts of incompletely established sessions.
Joinmastodon Mastodon
7.5
CVSSv3
CVE-2023-42450
Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused ...
Joinmastodon Mastodon 4.2.0
7.5
CVSSv3
CVE-2023-42451
Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 3.5.14, 4.0.10, 4.1.8, and 4.2.0-rc2, under certain circumstances, attackers can exploit a flaw in domain name normalization to spoof domains they do not own. Versions 3.5.14, 4.0.10, 4....
Joinmastodon Mastodon 4.2.0
Joinmastodon Mastodon
7.5
CVSSv3
CVE-2023-36461
Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout on individual read operations. Prior to versions 3.5.9, 4.0.5, and 4.1.3, a malicious server can indefinitely extend the duration of the resp...
Joinmastodon Mastodon
7.5
CVSSv3
CVE-2022-46405
Mastodon up to and including 4.0.2 allows malicious users to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accounts on certain other servers associated with a wildcard DNS A record, such that there is uncontrolled re...
Joinmastodon Mastodon
6.5
CVSSv3
CVE-2023-28853
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Starting in version 2.5.0 and prior to versions 3.5.8, 4.0.4, and 4.1.2, the LDAP query made during login is insecure and the attacker can perform ...
Joinmastodon Mastodon
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
NULL pointer dereference
CVE-2023-52689
CVE-2024-23803
client side
CVE-2023-52696
information disclosure
CVE-2024-35843
CVE-2024-27130
CVE-2023-52697
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »