References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Known Affected Software Configurations Switch to CPE 2.2

Change History

NIST AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

OR
     *cpe:2.3:a:usememos:memos:0.9.1:*:*:*:*:*:*:*

https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c No Types Assigned

https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c Patch

https://huntr.com/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6e No Types Assigned

https://huntr.com/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6e Exploit, Third Party Advisory

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft of sensitive information, such as login credentials, from users visiting the affected website. The issue has been fixed in version 0.10.0.

huntr.dev AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

huntr.dev CWE-79

huntr.dev https://github.com/usememos/memos/commit/46c13a4b7f675b92d297df6dabb4441f13c7cd9c [No types assigned]

huntr.dev https://huntr.com/bounties/1899ffb2-ce1e-4dc0-af96-972612190f6e [No types assigned]