877 matches found
CVE-2025-50738
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be...
PT-2025-31215
Name of the Vulnerable Software and Affected Versions: Memos versions up to v0.24.3 Description: The Memos application allows embedding of markdown images with arbitrary URLs. Viewing a memo containing such an image causes the user's browser to automatically fetch the image URL, potentially...
CVE-2025-50738: Exposure of Sensitive Information to an Unauthorized Actor
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be...
CVE-2024-29028
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1...
CVE-2024-29029
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticated users to enumerate the internal network and retrieve images. The response from the image request is then copied into the response of the current...
CVE-2024-29030
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file...
CVE-2023-0109
A stored cross-site scripting XSS vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This...
CVE-2023-0106
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...
CVE-2023-0112
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...
CVE-2023-0110
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...
CVE-2023-0111
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...
CVE-2023-0107
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...
CVE-2023-0108
Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...
CVE-2022-25978
All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting XSS due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme...
CVE-2022-4808
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1...
CVE-2022-4850
Cross-Site Request Forgery CSRF in GitHub repository usememos/memos prior to 0.9.1...
CVE-2022-4683
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0...
CVE-2022-4845
Cross-Site Request Forgery CSRF in GitHub repository usememos/memos prior to 0.9.1...
SUSE CVE-2025-22952
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks...
Server Side Request Forgery (SSRF)
github.com/usememos/memos is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied URLs, which allows an attacker to perform SSRF attacks...