Total 73 security vulnerabilities recorded for usememos software and firmware.
A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal....
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify o...
Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a craft...
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by othe...
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Mem...
Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their passwo...
Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify...
When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequ...
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing suc...
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited...
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a Ja...
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is ref...
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/image that allows unauthenticat...
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticate...
memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenti...
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1....
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2....
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2....
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2....
All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resou...
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0....
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0....
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0....
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0....