PT-2024-34883

Name of the Vulnerable Software and Affected Versions AuthKit library for Next.js versions prior to 0.13.2 Description The issue concerns the logging of refresh tokens to the console when the debug flag is enabled. This flag is disabled by default. There are no known workarounds for this issue...

memos vulnerable to Server-Side Request Forgery in /api/resource

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file...

GHSA-9CQM-MGV9-VV9J memos vulnerable to Server-Side Request Forgery and Cross-site Scripting

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current...

memos vulnerable to Server-Side Request Forgery and Cross-site Scripting

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current...

Frigate Security Breach

Frigate is a complete local NVR designed for home assistants with AI object detection by Blake Blackshear Personal Developer. A security vulnerability exists in Frigate versions prior to 0.13.2 that stems from the possibility that when uploading a file or retrieving a filename, a user may...

PT-2024-24930

Name of the Vulnerable Software and Affected Versions Frigate versions prior to 0.13.2 Description The issue arises from the lack of limitation on the length of filenames and the costly use of Unicode normalization with the form NFKD under the hood of the secure filename function. This can lead t...

WordPress Inline Google Spreadsheet Viewer plugin <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Krzysztof Zając in WordPress Plugin Inline Google Spreadsheet Viewer versions = 0.13.2...

CVE-2024-29029

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current...

CVE-2024-29030

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file...

CVE-2024-29028 memos vulnerable to an SSRF in /o/get/httpmeta

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1...

CVE-2024-29028

The CVE-2024-29028 entry concerns the memos service (GitHub project usememos/memos). It documents a Server-Side Request Forgery (SSRF) vulnerability in the API endpoint /o/get/httpmeta in version 0.13.2, allowing unauthenticated users to enumerate the internal network and read limited HTML values...

CVE-2024-29030 memos vulnerable to an SSRF in /api/resource

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file...

memos 安全漏洞

memos is an open source hosted memos center with knowledge management and social features. A security vulnerability exists in memos version 0.13.2, which originates in /api/resource and allows authenticated users to enumerate the internal network...

Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. As of commit c9aa2eeb9 access tokens which fail validation are rejected...

CVE-2023-4698

Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2...

CVE-2023-4698 Improper Input Validation in usememos/memos

Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2...

CVE-2023-4696 Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.13.2...

memos input validation error vulnerability

memos is an open source hosted memo center with knowledge management and social features. An input validation error vulnerability exists in memos versions prior to 0.13.2, which stems from incorrect input validation...

memos Access Control Error Vulnerability

memos is an open source hosted memo center with knowledge management and social features. An Access Control Error vulnerability exists in memos versions prior to 0.13.2, which stems from incorrect access control...

memos Security Vulnerabilities

memos is an open source hosted memo center with knowledge management and social features. A security vulnerability exists in memos versions prior to 0.13.2, which stems from incorrect privilege management...