713 matches found
CVE-2023-0107 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...
CVE-2023-0111 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...
Cross-site Scripting (XSS)
github.com/usememos/memos is vulnerable to stored cross-site scriptingXSS attacks. An attacker is able to inject and execute malicious javascript via the create post functionality...
Cross-Site Request Forgery (CSRF)
github.com/usememos/memos is vulnerable to cross-site request forgery. An attacker is able to add new members, via user API by exploiting the CSRF issue...
memos cross-site scripting vulnerability (CNVD-2023-04539)
memos is an open source hosted memo center with knowledge management and social features. memos versions prior to 0.9.1 contain a cross-site scripting vulnerability. An attacker could exploit this vulnerability to perform cross-site scripting attacks...
memos cross-site request forgery vulnerability (CNVD-2023-04537)
memos is an open source hosted meme center with knowledge management and social features. memos suffers from a cross-site request forgery vulnerability, which can be exploited by attackers to post on behalf of victims...
memos cross-site request forgery vulnerability
memos is an open source hosted memo center with knowledge management and social features. memos versions prior to 0.9.1 are vulnerable to cross-site request forgery. An attacker could exploit this vulnerability to perform cross-site request forgery attacks...
memos cross-site request forgery vulnerability (CNVD-2023-04536)
memos is an open source hosted memo center with knowledge management and social features. memos suffers from a cross-site request spoofing vulnerability, which can be exploited by attackers to manipulate the behavior of authenticated users by tricking them into clicking on malicious links or...
Denial Of Service (DoS)
github.com/usememos/memos is vulnerable to denial of service attacks. A malicious user is able to pass a huge number of characters through the Nickname parameter, causing the application to crash through the POST request...
Improper Authentication
github.com/usememos/memos is vulnerable to improper authentication. The vulnerability allows a remote attacker to use the Reset API on any user without consent via IDOR...
Information Disclosure
github.com/usememos/memos is vulnerable to information disclosure. An attacker is able to make a private memo into a public memo in order to view it using the memo ID via making a PATCH request to /api/memo/ and view the memo data of the victim...
Improper Access Control
github.com/usememos/memos is vulnerable to improper access control. Access control bypass through insecure direct object references allows an attacker to archive victim's memos...
Improper Access Control
github.com/usememos/memos is vulnerable to improper access control. Insufficient granularity of access control due to insecure direct object references allows an attacker to delete the victim's archived memos...
Improper Authorization
github.com/usememos/memos is vulnerable to improper authorization. The library uses insecure direct object references which allows an attacker to access all private memos of a user and edit them...
Insecure Direct Object References(IDOR)
github.com/usememos/memos is vulnerable to insecure direct object references. Improper Authorization due to insecure direct object references allow an attacker to trigger the Reset API on user's behalf...
Information Disclosure
github.com/usememos/memos is vulnerable to information disclosure. A remote authenticated attacker is able to view any content from private memos from other users via the API...
Improper Access Control
github.com/usememos/memos is vulnerable to improper access control. Authorization bypass allows a user to archive another user's memospublic / private by changing the post id...
Insecure Direct Object References(IDOR)
github.com/usememos/memos is vulnerable to insecure direct object references. The vulnerability allows an attacker to delete all the available memos Public/Private in the entire application since the memos id is numeric & is sequentially incremented which is easy to guess and perform the attack...
