Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in IBM® SDK Java™ Technology Edition

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, used by Enterprise Content Management System Monitor. Enterprise Content Management System Monitor has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21628 DESCRIPTION: Java SE is vulnerable to a...

Improper Access Control

github.com/usememos/memos is vulnerable to improper access control. The vulnerability allows authenticated remote attackers to edit and delete all other user shortcuts via the ID parameter...

Privilege Escalation

github.com/usememos/memos is vulnerable to privilege escalation. An authenticated user is able to delete all notes of the whole application via the DELETE API...

Improper Access Control

github.com/usememos/memos is vulnerable to improper access control. Insufficient granularity of access control due to insecure direct object references allows an attacker to delete the victim's archived memos...

Improper Authentication

github.com/usememos/memos is vulnerable to improper authentication. Improper authentication allows an attacker to delete posts on the user's behalf...

Insecure Direct Object References(IDOR)

github.com/usememos/memos is vulnerable to insecure direct object references. The vulnerability allows an attacker to delete all the available memos Public/Private in the entire application since the memos id is numeric & is sequentially incremented which is easy to guess and perform the attack...

PT-2022-27923 · Trendnet · Tew755Ap

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW755AP version 1.13B01 Description: A stack overflow issue was discovered, related to the del num parameter in the icp delete img sub 41DEDC function. Recommendations: For TRENDnet TEW755AP version 1.13B01, consider restricting...

usememos/memos has Insufficient Granularity of Access Control

An Insufficient Granularity of Access Control in usememos/memos prior to 0.9.0 can allow an attacker to delete a memo from the archives...

GHSA-GHX2-6V4G-9WMM usememos/memos makes Incorrect Use of Privileged APIs

In usememos/memos 0.9.0 and prior, a user with login permission can delete all notes of the whole application via API DELETE https://demo.usememos.com/api/memo/$idnote. The vulnerability will lose all user notes data throughout the system, causing damage to user data...

PT-2022-28106 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue concerns the incorrect use of privileged APIs in the usememos/memos GitHub repository. A user can archive any private memos, delete any shortcut, and edit any shortcut from other...

memos 安全漏洞

memos is an open source hosted memo center with knowledge management and social features. A security vulnerability exists in versions of memos prior to 0.9.1, which can be exploited by an attacker to delete user resources...

memos 授权问题漏洞

memos is an open source hosted meme center with knowledge management and social features. A vulnerability exists in memos prior to version 0.9.1 due to an authorization issue, which can be exploited by an attacker to archive any private memos, delete any shortcuts, and edit any shortcuts from oth...

PT-2022-28107 · Unknown +1 · Usememos/Memos +1

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to an Improper Access Control vulnerability, allowing for authorization bypass through a user-controlled key. This can result in a user being able to delete others' publ...

PT-2022-28096 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue involves the incorrect use of privileged APIs, allowing a user with login permission to delete all notes of the whole application. This can be achieved via the API endpoint...

memos 授权问题漏洞

memos is an open source hosted meme center with knowledge management and social features. A vulnerability in authorization issues exists in versions of memos prior to 0.9.1, which can be exploited by an attacker to delete any post by all users via IDOR...

memos 访问控制错误漏洞

memos is an open source hosted memo center with knowledge management and social features. An access control error vulnerability exists in versions prior to memos 0.9.1, which can be exploited by an attacker to edit and delete all other user shortcuts...

PT-2022-28114 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to Insufficient Granularity of Access Control in the GitHub repository usememos/memos. This can allow an attacker to delete a memo from the archives. Recommendations: Fo...

CVE-2022-4748

A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The...

Path traversal

A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The...

CVE-2022-4748 FlatPress File Delete panel.mediamanager.file.php doItemActions path traversal

A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The...