713 matches found
PT-2022-28104 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to improper access control, allowing for authorization bypass through a user-controlled key. This affects the usememos/memos GitHub repository. No information is provide...
CVE-2022-4803 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1...
CVE-2022-4813
Vulnerability : usememos/memos prior to 0.9.1 has insufficient granularity of access control, enabling an IDOR on archived memos. Root cause : inadequate authorization checks on archive objects. Impact : attacker could delete archived memos (per multiple sources mentioning deletion via IDOR). Aff...
CVE-2022-4803 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1...
CVE-2022-4804 Improper Authorization in usememos/memos
Improper Authorization in GitHub repository usememos/memos prior to 0.9.1...
PT-2022-28114 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to Insufficient Granularity of Access Control in the GitHub repository usememos/memos. This can allow an attacker to delete a memo from the archives. Recommendations: Fo...
CVE-2022-4809 Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1...
CVE-2022-4814 Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1...
Cross Site Request Forgery in Create a Memo Functionality (POST /api/memo)
Description I have discovered in Memos a CSRF Vulnerability in Create a Memo Functionality POST /api/memo. I have identified that it is possible to manipulate the actions of authenticated users by tricking them into clicking on a malicious link or visiting a malicious website while they are logge...
GHSA-J593-H5V3-45X6 usememos/memos may leak user information to an authenticated user
usememos/memos 0.9.0 and prior has endpoint that leaks user information like names, email, role, and OpenID to an authenticated user. A patch is available at commit 05b41804e33a34102f1f75bb2d69195dda6a1210 on the main branch...
GHSA-97RC-MM5J-F6RJ usememos/memos vulnerable to stored Cross-site Scripting
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
GHSA-V92P-PHMP-XFFR usememos/memos vulnerable to stored Cross-site Scripting
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
usememos/memos may leak user information to an authenticated user
usememos/memos 0.9.0 and prior has endpoint that leaks user information like names, email, role, and OpenID to an authenticated user. A patch is available at commit 05b41804e33a34102f1f75bb2d69195dda6a1210 on the main branch...
GHSA-C2V4-8R9G-G5XJ usememos/memos vulnerable to stored Cross-site Scripting
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
usememos/memos vulnerable to stored Cross-site Scripting
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
usememos/memos Denial of Service vulnerability
Denial of Service in GitHub repository usememos/memos 0.9.0 and prior. A patch is available on the main branch at commit number f888c628408501daf639de07b90a72ab443b0f4c...
GHSA-33M8-F4HW-WM3Q usememos/memos Denial of Service vulnerability
Denial of Service in GitHub repository usememos/memos 0.9.0 and prior. A patch is available on the main branch at commit number f888c628408501daf639de07b90a72ab443b0f4c...
CVE-2022-4767
Denial of Service in GitHub repository usememos/memos prior to 0.9.1...