CVE-2024-29030

memos vulnerable to an SSRF in /api/resource

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.

CVSS 3.1 · 5.8 Medium EPSS 1.1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2024-29028

memos vulnerable to an SSRF in /o/get/httpmeta

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1.

CVSS 3.1 · 5.8 Medium EPSS 1.0% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4609

Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4734

Improper Removal of Sensitive Information Before Storage or Transfer in usememos/memos

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4767

Denial of Service in usememos/memos

Denial of Service in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4806

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4807

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4808

Improper Privilege Management in usememos/memos

Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4809

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4689

Improper Access Control in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4690

Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4691

Cross-site Scripting (XSS) - Stored in usememos/memos

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4796

Incorrect Use of Privileged APIs in usememos/memos

Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4797

Improper Restriction of Excessive Authentication Attempts in usememos/memos

Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4798

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4799

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4800

Improper Verification of Source of a Communication Channel in usememos/memos

Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4801

Insufficient Granularity of Access Control in usememos/memos

Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4802

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos

CVE-2022-4803

Authorization Bypass Through User-Controlled Key in usememos/memos

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Usememos

Products

Memos