CVE-2022-4767

The CVE-2022-4767 entry concerns a Denial of Service vulnerability in the GitHub repository usememos/memos, affecting versions prior to 0.9.1. The underlying issue is triggered in legacy releases and can impact availability. A patched version is available; remediation is to upgrade to 0.9.1 or la...

CVE-2022-4767 Denial of Service in usememos/memos

Denial of Service in GitHub repository usememos/memos prior to 0.9.1...

memos 跨站脚本漏洞

memos is an open source hosted memo center with knowledge management and social features. A cross-site scripting vulnerability exists in memos, which can be exploited by an attacker to be able to steal a user's cookie...

PT-2022-28081 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is a Denial of Service vulnerability in the GitHub repository usememos/memos. A patch is available on the main branch at commit number f888c628408501daf639de07b90a72ab443b0f4c...

memos 跨站脚本漏洞

memos is an open source hosted memo center with knowledge management and social features. A cross-site scripting vulnerability exists in memos, which originates when a user uploads a file with the extension .svg and accesses it directly, the server responds with Content-type: image/svg+xml causin...

memos 信息泄露漏洞

memos is an open source hosted memo center with knowledge management and social features. An information disclosure vulnerability exists in versions of memos prior to 0.9.1, which arises from the exposure of sensitive information to unauthorized actors...

CVE-2022-4767 Denial of Service in usememos/memos

Denial of Service in GitHub repository usememos/memos prior to 0.9.1...

memos 资源管理错误漏洞

memos is an open source hosted memo center with knowledge management and social features. A resource management error vulnerability exists in versions of memos prior to 0.9.1, which stems from a denial of service...

CVE-2022-4767 Denial of Service in usememos/memos

Denial of Service in GitHub repository usememos/memos prior to 0.9.1...

An attacker can be post message in other memos page

Description An attacker can be post malicious content to other user's memos page via POST request, attacker just add an creatorID into body request and send it with Burpsuite Here is video poc: https://drive.google.com/file/d/1dNKo-ybfguam4YdvmluYujN2nkTG5D9G/view?usp=sharelink Proof of Concept...

CVE-2022-4734 Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1...

PT-2022-28048 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue concerns the exposure of sensitive user information, including names, email, role, and OpenID, to an authenticated user. This is due to improper removal of sensitive information...

CVE-2022-4734 Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1...

CVE-2022-4692

Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...

Stored XSS in memos while creating

Description After login create a new memo with the following XSS payload " and click save that will make alert Proof of Concept "...

Archive any private memos + Delete any Shortcut + Edit any Shortcut from other users

Description User can archive any private memos, Delete any Shortcut and Edit any Shortcut from other users via api PATCH /api/memo/8 HTTP/1.1 "id":8,"rowStatus":"ARCHIVED" PATCH /api/shortcut/2 HTTP/1.1 "id":2,"title":"shortahihix","payload":"" DELETE /api/shortcut/2 Proof of Concept Login to...

View any content private memos from other users

Description User can view any content from private private memos from other users via api PATCH /api/memo/8 HTTP/1.1 "id":8,"rowStatus":"ARCHIVED" Proof of Concept Login to website in brower 1 with user A. Login to website in brower 2 with user B. Example: User B have private nemo with id 8. With...

GHSA-C8JH-VCJH-FX2W usememos/memos vulnerable to stored cross-site scripting (XSS)

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 has a feature to upload file and display it, and by uploading a crafted SVG file, an attacker could perform a stored cross-site scripting attack with the image direct link. Thi...

GHSA-FV6C-RFG3-GVJW usememos/memos makes Incorrect Use of Privileged APIs

Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0...

GHSA-QCW2-492V-57XJ usememos/memos missing Secure cookie attribute

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking...