Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
59 results · page 1 of 2
Nov 15, 2024A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1.CVE-2023-0109 · Other software · usememos · reported by security@huntr.devMedium 5.4
A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.CVE-2023-5036 · Other software · usememos · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.CVE-2023-4698 · Other software · usememos · reported by security@huntr.devHigh 7.5
Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.CVE-2023-4697 · Other software · usememos · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2023Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.CVE-2023-4696 · Other software · usememos · reported by security@huntr.devCritical 9.8
Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, whicCVE-2022-25978 · Other software · Usememos · reported by report@snyk.ioMedium 5.4
All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme.
- Product
- Memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0112 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0111 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0110 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0108 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0107 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-0106 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4866 · Other software · usememos · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4865 · Other software · usememos · reported by security@huntr.devCritical 9
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4863 · Other software · usememos · reported by security@huntr.devMedium 6.5
Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4851 · Other software · usememos · reported by security@huntr.devMedium 5.3
Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4850 · Other software · usememos · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4849 · Other software · usememos · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4848 · Other software · usememos · reported by security@huntr.devMedium 5.7
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4847 · Other software · usememos · reported by security@huntr.devMedium 6.5
Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4846 · Other software · usememos · reported by security@huntr.devMedium 6.5
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4845 · Other software · usememos · reported by security@huntr.devMedium 4.3
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4844 · Other software · usememos · reported by security@huntr.devHigh 8.8
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4841 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4840 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4839 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4814 · Other software · usememos · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4813 · Other software · usememos · reported by security@huntr.devMedium 4.3
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4812 · Other software · usememos · reported by security@huntr.devMedium 6.5
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.CVE-2022-4811 · Other software · usememos · reported by security@huntr.devHigh 8.3
Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4810 · Other software · usememos · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4809 · Other software · usememos · reported by security@huntr.devHigh 8.8
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4808 · Other software · usememos · reported by security@huntr.devHigh 8.8
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4807 · Other software · usememos · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4806 · Other software · usememos · reported by security@huntr.devMedium 5.3
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4805 · Other software · usememos · reported by security@huntr.devMedium 4.3
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4804 · Other software · usememos · reported by security@huntr.devMedium 5.3
Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4803 · Other software · usememos · reported by security@huntr.devHigh 8.8
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4802 · Other software · usememos · reported by security@huntr.devMedium 5.4
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4801 · Other software · usememos · reported by security@huntr.devMedium 5.3
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4800 · Other software · usememos · reported by security@huntr.devMedium 6.5
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4799 · Other software · usememos · reported by security@huntr.devMedium 6.5
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4798 · Other software · usememos · reported by security@huntr.devMedium 5.3
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4797 · Other software · usememos · reported by security@huntr.devMedium 4.3
Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2022Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4796 · Other software · usememos · reported by security@huntr.devHigh 8.1
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Denial of Service in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4767 · Other software · usememos · reported by security@huntr.devHigh 7.5
Denial of Service in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-4734 · Other software · usememos · reported by security@huntr.devHigh 8.1
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-4695 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-4694 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.CVE-2022-4691 · Other software · usememos · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
- Product
- usememos/memos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.