These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
Lemmy is a link aggregator and forum for the fediverse. The vulnerability is caused by the rendering of Markdown in src/shared/markdown.ts for post bodies, comment bodies, private messages, and community and site sidebars through mdToHtml, which returns a raw __html object that Inferno injects without a sanitizer pass. This allows an approved member or a remote federated instance to store crafted content [truncated]
A vulnerability in Lemmy, a link aggregator and forum for the fediverse, allows a blocked sender to edit a private message that the recipient can still see. This issue provides a post-block harassment path and is fixed in versions 0.19.19 and 1.0.0-alpha.18. The vulnerability exists because the edit path for private messages skips the block check that is present when creating new private messages. Specifi [truncated]
A junior moderator can strip senior moderators from the community moderator list in Lemmy versions prior to 0.19.19 and 1.0.0-alpha.18. This issue arises from insufficient rank checks in the handling of ActivityPub Remove activities. The vulnerability allows lower-ranked moderators to remove higher-ranked moderators by sending a signed ActivityPub Remove activity to the target instance. This can disrupt c [truncated]
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint returns different errors based on whether a username or email address exists. This discrepancy allows an attacker to enumerate valid usernames or email addresses. The issue is addressed in Lemmy versions 0.19.19 and 1.0.0-beta.1. Affected administrators should verify their instance versions an [truncated]
A vulnerability in Lemmy, a link aggregator and forum for the fediverse, allows a community moderator to feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities. This issue, fixed in versions 0.19.19 and 1.0.0-alpha.20, enables a moderator to target an unrelated post owned by another community, push it into featured feeds and listings, or undo anothe [truncated]