CVE-2023-0112

CVE-2023-0112 is an XSS vulnerability affecting usememos/memos before version 0.10.0. The issue is a Stored XSS in the GitHub repository where user input can be stored and later rendered. Documents confirm affected software, vulnerable component/file (the memos codebase prior to 0.10.0), and the ...

CVE-2022-4690

CVE-2022-4690 is a stored XSS in usememos/memos prior to 0.9.0. An attacker could abuse the SVG upload/display feature by submitting a crafted SVG to execute script via the image link. Impact is stored XSS within memos prior to upgrade. Remediation: upgrade to version 0.9.0 or later; as a workaro...

CVE-2022-4845

CVE-2022-4845 affects the usememos/memos project prior to version 0.9.1, with a Cross-Site Request Forgery (CSRF) vulnerability reported. The issue arises from CSRF in the web application, enabling unauthorized actions if a user is lured to a malicious site while authenticated. Affected software ...

CVE-2022-4695

CVE-2022-4695 affects usememos/memos prior to version 0.9.0. The issue is described as a Stored Cross-site Scripting (XSS) vulnerability arising from how user input is handled and stored (e.g., when creating a post) and later displayed. Documented impact is XSS with potential interaction required...

CVE-2023-0106

The CVE-2023-0106 issue affects usememos/memos before version 0.10.0 and is a Stored Cross-site Scripting (XSS) vulnerability stemming from unvalidated link tagging. Multiple connected sources (CNVD, OSV, GHSA, CNVD CNVD, CNNVD) describe a stored XSS condition in this project and confirm the affe...

CVE-2022-4814

CVE-2022-4814 affects usememos/memos prior to 0.9.1. Multiple connected sources describe an improper access control vulnerability (IDOR) that can allow archiving another user’s memo. The core issue is an authorization flaw in how memos handles memo access, enabling unauthorized archival actions. ...

CVE-2023-0108

CVE-2023-0108 is a stored cross-site scripting (XSS) vulnerability in the open-source memos project (usememos/memos) prior to version 0.10.0. Multiple connected sources confirm stored XSS in GitHub repository code, including reports tying the issue to the Resources module and the ability for atta...

CVE-2022-4683

CVE-2022-4683 affects usememos/memos prior to 0.9.0. The vulnerability is a missing Secure attribute on cookies in HTTPS sessions, enabling potential cookie exposure and session hijacking. Exploitation details are not provided in the supplied documents. remediation: upgrade to version 0.9.0 or la...

CVE-2022-4688

CVE-2022-4688 affects usememos/memos; versions prior to 0.9.0 are vulnerable to improper authorization. The issue can allow a user to modify other users’ nicknames, usernames, and emails without permission. No exploit details are provided in the sources beyond the general description. Mitigation:...

CVE-2022-4689

CVE-2022-4689 affects usememos/memos before 0.9.0. The root cause is improper access control, enabling an attacker to take over an account by altering HTTP header values. Public sources describe an account-takeover risk in versions prior to 0.9.0 (GHSA-W57V-6XP4-RM2V) and related OSV entries; CVS...