CVE-2023-27888

Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo function of the affected product...

PT-2023-21394 · Joruri Gw · Joruri Gw

Name of the Vulnerable Software and Affected Versions: Joruri Gw versions 3.2.5 and earlier Description: A cross-site scripting issue allows a remote authenticated attacker to inject an arbitrary script via the Message Memo function of the affected product. Recommendations: For versions 3.2.5 and...

CVE-2023-27888

Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo function of the affected product...

Joruri Gw vulnerable to cross-site scripting

Overview Joruri Gw provided by SiteBridge Inc. is groupware. Message Memo function of Joruri Gw contains a cross-site scripting vulnerability CWE-79. Tsutomu Aramaki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

SUSE CVE-2007-1002

Format string vulnerability in the writehtml function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo...

memos 跨站脚本漏洞

memos is an open source hosted memo center with knowledge management and social features. A security vulnerability exists in memos that stems from insufficient inspection of external resources. An attacker could exploit the vulnerability to perform a cross-site scripting attack...

memos cross-site scripting vulnerability (CNVD-2023-05747)

memos is an open source hosted memo center with knowledge management and social features. memos versions prior to 0.10.0 have a cross-site scripting vulnerability that stems from the fact that it allows link tagging without validation, which could be exploited by an attacker to implement cross-si...

memos cross-site scripting vulnerability (CNVD-2023-04539)

memos is an open source hosted memo center with knowledge management and social features. memos versions prior to 0.9.1 contain a cross-site scripting vulnerability. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

Information Disclosure

github.com/usememos/memos is vulnerable to information disclosure. An attacker is able to make a private memo into a public memo in order to view it using the memo ID via making a PATCH request to /api/memo/ and view the memo data of the victim...

usememos/memos has Insufficient Granularity of Access Control

An Insufficient Granularity of Access Control in usememos/memos prior to 0.9.0 can allow an attacker to delete a memo from the archives...

GHSA-PP3P-6JJH-RMG7 usememos/memos Improper Access Control vulnerability

An Improper Access Control vulnerability in usememos/memos 0.9.0 and prior can result in a user deleting others' public and private memos...

CVE-2022-4800

Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1...

IDOR to delete memo from archives

Description Insecure direct object references IDOR are a type of access control vulnerability that arises when an application uses user-supplied input to access objects directly. Proof of Concept 1 Login into your account at demo.usememos.com 2 Turn on your burpsuite proxy 3 Go to archived memos ...

IDOR to archive victims memo

Description Insecure direct object references IDOR are a type of access control vulnerability that arises when an application uses user-supplied input to access objects directly. Proof of Concept 1 Login into your account at demo.usememos.com 2 Turn on your burpsuite proxy 3 Click on the three do...

PT-2022-28114 · Unknown · Usememos/Memos

Name of the Vulnerable Software and Affected Versions: usememos/memos versions prior to 0.9.1 Description: The issue is related to Insufficient Granularity of Access Control in the GitHub repository usememos/memos. This can allow an attacker to delete a memo from the archives. Recommendations: Fo...

memos 访问控制错误漏洞

memos is an open source hosted meme center with knowledge management and social features. An access control error vulnerability exists in memos versions prior to 0.9.1, which can be exploited by an attacker to view any content in a private private memo from another user via the api...

Unauthorized Attacker Can Change Visibility Status of Victim's Memos

An attacker can make a private memo into a public memo in order to view it. All the attacker needs to know is the memo ID and they can make a PATCH request to /api/memo/ with the following request data: "id":,"visibility":"PUBLIC","resourceIdList": Then the attacker can visit the memo URL & view...

Stored XSS while adding a memo

Description Stored cross-site scripting also known as second-order or persistent XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. Proof of Concept Payload: " 1 Go to https://demo.usememos.com/ and login...

Access all Private Memos by unauthorized user

Description After login , I create a new memo and post it then i tried to edit it So in editing POST request you can find the memo id in POST data and in the URL if you change it to any private memo you can access it Also you can change the private memo visibility status and content . Proof of...

usememos/memos vulnerable to stored cross-site scripting (XSS)

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 has a feature to upload file and display it, and by uploading a crafted SVG file, an attacker could perform a stored cross-site scripting attack with the image direct link. Thi...