799 matches found
GHSA-QCW2-492V-57XJ usememos/memos missing Secure cookie attribute
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking...
GHSA-C8JH-VCJH-FX2W usememos/memos vulnerable to stored cross-site scripting (XSS)
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 has a feature to upload file and display it, and by uploading a crafted SVG file, an attacker could perform a stored cross-site scripting attack with the image direct link. Thi...
usememos/memos Authorization Bypass Through User-Controlled Key vulnerability
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0...
usememos/memos missing Secure cookie attribute
usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking...
usememos/memos makes Incorrect Use of Privileged APIs
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4690
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4689
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4688
Improper Authorization in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4684
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0...
Session fixation
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0...
PT-2022-28010 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation, allowing attackers to inject malicious scripts. This...
PT-2022-28001 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to stored Cross-site Scripting XSS in the usememos/memos GitHub repository. This repository is for an open-source, self-hosted memo hub that includes knowledge managemen...
CVE-2022-4691 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
PT-2022-27999 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue concerns improper authorization in the usememos/memos GitHub repository. This repository is for an open-source, self-hosted memo hub that includes knowledge management and...
CVE-2022-4683 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in usememos/memos
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0...
PT-2022-27996 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue concerns the incorrect use of privileged APIs in the GitHub repository usememos/memos. Recommendations: For versions prior to 0.9.0, update to version 0.9.0 or later to resolve the...
PT-2022-28000 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to improper access control in the usememos/memos GitHub repository, allowing an attacker to take over an account. This is possible by changing header values in the HTTP...
CVE-2022-4687 Incorrect Use of Privileged APIs in usememos/memos
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0...
memos 安全漏洞
memos is an open source hosted memo center with knowledge management and social features. A security vulnerability exists in memos versions prior to 0.9.0, which stems from incorrect use of privileged APIs...
