Nexryai

Name of the Vulnerable Software and Affected Versions: Misskey versions 12.109.0 through 2025.2.0-alpha.0 Description: Misskey is an open source, federated social media platform. Due to a lack of CSRF protection and the lack of proper security attributes in the authentication cookies of Bull's dashboard, some of the APIs of bull-board may be subject to CSRF attacks. There is a risk of this vulnerability being used for attacks with relatively large impact on availability and integrity, such as the ability to add arbitrary jobs. Recommendations: For versions 12.109.0 through 2025.2.0-alpha.0, update to version 2025.2.0-alpha.0 to resolve the issue. As a temporary workaround, block all access to the `/queue` directory with a web application firewall (WAF).

Name of the Vulnerable Software and Affected Versions: Concorde versions prior to 12.25Q1.1 Description: The issue arises from a lack of CSRF countermeasures and improper settings of cookies for MediaProxy authentication, allowing an attacker to bypass MediaProxy authentication. This enables the attacker to load any image without restrictions under certain circumstances. In versions prior to 12.24Q2.3, the vulnerability also bypasses bull-board authentication, potentially leading to significant impacts on availability and integrity. Recommendations: For versions prior to 12.25Q1.1, update to version 12.25Q1.1 to fix the security flaw. As a temporary workaround, consider restricting access to MediaProxy authentication and the job queue management page (bull-board) until the update is applied. No other effective workarounds are available apart from updating to the patched version.

**Name of the Vulnerable Software and Affected Versions** nexkey versions prior to 12.122.2 **Description** The issue is related to insufficient validation of ActivityPub requests received in the inbox, which could allow any user to impersonate another user in certain circumstances. **Recommendations** For versions prior to 12.122.2, update to version 12.122.2 to resolve the issue. As a temporary workaround, consider restricting access to the inbox functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Nexkey versions prior to 12.121.9 **Description** The issue is related to incomplete URL validation, which can allow users to bypass authentication and access the job queue dashboard. This is a problem in a decentralized social media platform. **Recommendations** For versions prior to 12.121.9, update to version 12.121.9 to resolve the issue. As a temporary workaround, consider blocking access to the vulnerable endpoint using tools such as Cloudflare's WAF.