Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://poa.st/objects/6817d32d-e459-47ae-9946-9217ca0f2689">anime graf mays ?️? (graf@poa.st)'s status on Thursday, 15-Feb-2024 00:54:36 JST</a><a href="https://poa.st/users/graf" title="graf@poa.st"><img src="https://gnusocial.jp/avatar/990-48-20220724152015.webp" width="48" height="48" alt="anime graf mays ?️?" style="position: absolute; left: 0; top: 0;">anime graf mays ?️?</a><div><a href="https://lizards.live/@vriska/111930602341203387" rel="in-reply-to">in reply to</a><ul><li></ul></div></section><article><a href="https://lizards.live/@vriska">@vriska</a> its the same one, nothing new listed here <a href="https://github.com/mastodon/mastodon/security/advisories">github.com/mastodon/mastodon/security/advisories</a><br><br>except this one from two weeks ago <a href="https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw">github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw</a><br><br>still a big one and you should probably poke moon</article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/2715712#notice-5387720">In conversation</a><time datetime="2024-02-15T00:54:36+09:00" title="Thursday, 15-Feb-2024 00:54:36 JST">about a year ago</time> <span>from <span><a href="https://poa.st/objects/6817d32d-e459-47ae-9946-9217ca0f2689" rel="external" title="Sent from poa.st via ActivityPub">poa.st</a></span></span><a href="https://poa.st/objects/6817d32d-e459-47ae-9946-9217ca0f2689">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: opengraph.githubassets.com</div><h5><a href="https://github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw">Remote user impersonation and takeover</a></h5><div></div></header><div>### SummaryDue to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account.Every Mastodon version prior to 3.5.17 is vulnerable, as well as...</div><footer></footer></article></li><li><article><header><div>Domain not in remote thumbnail source whitelist: github.githubassets.com</div><h5><a href="https://github.com/mastodon/mastodon/security/advisories">Build software better, together</a></h5><div></div></header><div>GitHub is where people build software. More than 100 million people use GitHub to discover, fork, and contribute to over 420 million projects.</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
anime graf mays ?️? (graf@poa.st)'s status on Thursday, 15-Feb-2024 00:54:36 JSTanime graf mays ?️?
in reply to
- 『VRISKA』
@vriska its the same one, nothing new listed here github.com/mastodon/mastodon/security/advisories

except this one from two weeks ago github.com/mastodon/mastodon/security/advisories/GHSA-3fjr-858r-92rw

still a big one and you should probably poke moon
In conversationabout a year ago from poa.stpermalink
Attachments
1. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  Remote user impersonation and takeover
  ### Summary Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is vulnerable, as well as...
2. Domain not in remote thumbnail source whitelist: github.githubassets.com
  Build software better, together
  GitHub is where people build software. More than 100 million people use GitHub to discover, fork, and contribute to over 420 million projects.

Public

Embed Notice

HTML Code

Corresponding Notice