713 matches found
Memos 0.13.2 - Server-Side Request Forgery
SSRF vulnerabilities exist in the memos API service /o/get/httpmeta that allow unauthenticated and authenticated users to enumerate and read from the internal network. In addition, one SSRF vulnerability leads to a reflected XSS vulnerability, which may allow an attacker complete control over the...
Elestio Memos <= v0.24.0 - Server-Side Request Forgery
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks. id: CVE-2025-22952 info: name: Elestio Memos = v0.24.0 - Server-Side Request Forgery author: iamnoooob,rootxharsh,pdresearc...
CVE-2023-4696
CVE-2023-4696 由于对 JWT 令牌处理不当导致的账户接管漏洞(memos v0.13.2) 描述 我想揭示一个我在 usememos/memos 系统中最近发现的重要安全漏洞。该漏洞可能允许任何用户以相对简单的方式修改其他用户的数据,包括其密码。通过利用这一缺陷,攻击者可能获得对敏感信息的未授权访问,从而导致一系列安全和隐私问题。让我们深入了解这一发现的细节。 该漏洞的核心在于 JSON Web 令牌(JWT)的处理方式,这是一种常用于安全数据交换的机制。在 usememos/memos 系统中,服务器未能充分验证 JWT 令牌是否合法签发。这一疏忽意味着,即使是使用...
CVE-2023-4698
CVE-2023-4698 usememos/memos 0.13.2 中的本地文件包含LFI漏洞 描述 今天,我想聚焦一项重大发现——在 usememos/memos 中识别出一个关键安全漏洞。该漏洞属于本地文件包含LFI类别,对运行版本低于 0.13.2 的 usememos/memos 系统构成严重威胁。此问题已被分配 CVE 标识符 CVE-2023–4698。在这篇博客中,我们将剖析此漏洞,理解其影响,并强调修复它的紧迫性。 理解 LFI 漏洞...
CVE-2026-84203
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...
CVE-2026-84203 Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...
CVE-2026-84203
Memos versions 0.26.0 through 0.30.0 contain an insufficient session expiration flaw: refresh tokens are not revoked when a user changes their password. An attacker holding a stolen refresh token can call the RefreshToken RPC to mint new access tokens and rotate the refresh token indefinitely, ef...
EUVD-2026-69290
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...
CVE-2026-84203 Memos 0.26.0 through 0.30.0 Insufficient Session Expiration on Password Change
Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely,...
CVE-2026-82476
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
CVE-2026-82476 Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
CVE-2026-82476
Memos through 0.30.0 is affected by an SSRF vulnerability in its link-metadata fetcher. The root cause is the omission of the 100.64.0.0/10 carrier-grade NAT address range from the server's IP validation logic. An unauthenticated remote attacker can exploit this to make the server request interna...
EUVD-2026-68132
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
CVE-2026-82476 Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
PT-2026-83455
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read...
CVE-2026-75110
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...
CVE-2026-75110
CVE-2026-75110 is a critical authentication bypass in MemOS , a memory operating system for LLMs and AI agents. When AUTH_ENABLED=true but the undocumented INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open due to ...
CVE-2026-75110 MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...
EUVD-2026-60389
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...
CVE-2026-75110 MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...