521 matches found
CVE-2022-4695 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4692 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
PT-2022-28006 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation, allowing an attacker to inject...
PT-2022-27987 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to a sensitive cookie in an HTTPS session without the 'Secure' attribute. This affects an open-source, self-hosted memo hub with knowledge management and socialization...
CVE-2022-4688 Improper Authorization in usememos/memos
Improper Authorization in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4686 Authorization Bypass Through User-Controlled Key in usememos/memos
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4684 Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4689 Improper Access Control in usememos/memos
Improper Access Control in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4690 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
PT-2022-27995 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to an Authorization Bypass Through User-Controlled Key and Improper Authentication in the usememos/memos GitHub repository. Recommendations: For versions prior to 0.9.0,...
PT-2022-27993 · Fortinet · Fortigate
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to improper access control in the usememos/memos GitHub repository. There have been real-world incidents where this issue was exploited, including a leak of data from ov...
CVE-2022-4686
CVE-2022-4686 affects the GitHub-hosted project usememos/memos, with versions prior to 0.9.0 vulnerable to an Authorization Bypass via a user-controlled key. The root cause, as described across sources, is improper/authentication-related handling that lets an attacker bypass authorization checks....
CVE-2022-4688 Improper Authorization in usememos/memos
Improper Authorization in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4695 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
Stored XSS via SVG File
Description usememos has a feature to upload file and display it. By uploading a crafted SVG files, the users can perform Stored XSS attack with the image direct link. Copy the following code and save as filename.svg. Proof of Concept filename.svg alertdocument.location; 1. Login as user 2. creat...
Cross-site Scripting (XSS)
github.com/usememos/memos is vulnerable to cross-site scripting. The vulnerability exists in the registerResourceRoutes function in resource.go because memos allow users to upload a file and make it public to others which may allow an attacker to gain access to potentially sensitive information...
CVE-2022-4609 Cross-site Scripting (XSS) - Stored in usememos/memos
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...
PT-2022-27734 · Unknown · Usememos/Memos
Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.0 Description: The issue is related to stored Cross-site Scripting XSS in the usememos/memos GitHub repository. This allows for malicious scripts to be stored and executed on the platform. A patch is...
CVE-2022-4609
CVE-2022-4609 affects usememos/memos prior to 0.9.0. It is a stored Cross-site Scripting (XSS) vulnerability in the GitHub repository, allowing attacker-supplied scripts to be stored and executed in the application. Remediation: upgrade to version 0.9.0 or later (patch anticipated in 0.9.0). Some...