CVE-2022-4801

CVE-2022-4801 affects usememos/memos versions prior to 0.9.1 and is caused by Insufficient Granularity of Access Control (authorization flaw). The vulnerability can allow an attacker to archive any user’s post (public or private), as described across multiple sources (GHSA/OSV/Red Hat references)...

CVE-2022-4809

CVE-2022-4809 affects the usememos/memos project (GitHub repository) and is caused by improper access control in versions prior to 0.9.1. The vulnerability can allow an attacker to change user properties (username, email, display name), leading to full account takeover as described in multiple so...

CVE-2022-4845

CVE-2022-4845 affects the usememos/memos project prior to version 0.9.1, with a Cross-Site Request Forgery (CSRF) vulnerability reported. The issue arises from CSRF in the web application, enabling unauthorized actions if a user is lured to a malicious site while authenticated. Affected software ...

CVE-2022-4690

CVE-2022-4690 is a stored XSS in usememos/memos prior to 0.9.0. An attacker could abuse the SVG upload/display feature by submitting a crafted SVG to execute script via the image link. Impact is stored XSS within memos prior to upgrade. Remediation: upgrade to version 0.9.0 or later; as a workaro...

CVE-2022-4814

CVE-2022-4814 affects usememos/memos prior to 0.9.1. Multiple connected sources describe an improper access control vulnerability (IDOR) that can allow archiving another user’s memo. The core issue is an authorization flaw in how memos handles memo access, enabling unauthorized archival actions. ...

CVE-2022-4683

CVE-2022-4683 affects usememos/memos prior to 0.9.0. The vulnerability is a missing Secure attribute on cookies in HTTPS sessions, enabling potential cookie exposure and session hijacking. Exploitation details are not provided in the supplied documents. remediation: upgrade to version 0.9.0 or la...

CVE-2023-0106

The CVE-2023-0106 issue affects usememos/memos before version 0.10.0 and is a Stored Cross-site Scripting (XSS) vulnerability stemming from unvalidated link tagging. Multiple connected sources (CNVD, OSV, GHSA, CNVD CNVD, CNNVD) describe a stored XSS condition in this project and confirm the affe...

CVE-2023-0108

CVE-2023-0108 is a stored cross-site scripting (XSS) vulnerability in the open-source memos project (usememos/memos) prior to version 0.10.0. Multiple connected sources confirm stored XSS in GitHub repository code, including reports tying the issue to the Resources module and the ability for atta...

CVE-2022-4689

CVE-2022-4689 affects usememos/memos before 0.9.0. The root cause is improper access control, enabling an attacker to take over an account by altering HTTP header values. Public sources describe an account-takeover risk in versions prior to 0.9.0 (GHSA-W57V-6XP4-RM2V) and related OSV entries; CVS...

CVE-2022-4688

CVE-2022-4688 affects usememos/memos; versions prior to 0.9.0 are vulnerable to improper authorization. The issue can allow a user to modify other users’ nicknames, usernames, and emails without permission. No exploit details are provided in the sources beyond the general description. Mitigation:...