33 matches found
CVE-2026-49453
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...
EUVD-2026-84167
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...
CVE-2026-49453
Joplin (open-source note-taking app) contains a path traversal in its resource synchronization mechanism prior to versions 3.6.15 and 3.7.2 . The root cause is that synchronized resource metadata fields (id or file_extension) are stored unvalidated by BaseItem.unserialize(), then concatenated int...
CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...
CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...
CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...
PT-2026-96249
Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.6.15 Joplin versions prior to 3.7.2 Description Joplin accepts synchronized resource metadata where the id or file extension contains path-separator or parent-directory characters. The BaseItem.unserialize function...
EUVD-2014-3178
Malware in sbrugna...
EUVD-2013-2860
Malware in sbrugna...
Linux Distros Unpatched Vulnerability : CVE-2018-6066
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via...
SUSE CVE-2018-6066
Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2018-6066
Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2018-6066
Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
UBUNTU-CVE-2018-6066
Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2018-6066
CVE-2018-6066 affects Google Chrome (Blink) due to lack of CORS checking in ResourceFetcher/ResourceLoader, enabling a remote attacker to leak cross-origin data via crafted HTML. Publicly reported as a Same Origin Policy bypass in Chrome/Chromium before 65.0.3325.146; multiple vendors referenced ...
CVE-2018-6066
Removed by vendor...
CVE-2018-6066: Exposure of Sensitive Information to an Unauthorized Actor
Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2018-6066
Lack of CORS checking by ResourceFetcher/ResourceLoader in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
The vulnerability of Google Chrome browser allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability exists in the ResourceFetcher::canRequest function in core/fetch/ResourceFetcher.cpp of Blink for Google Chrome. It stems from an improper limitation on resource requests related to SVG files. Exploiting this vulnerability allows malicious actors to circumvent domain restriction...