Cross-site Scripting (XSS) – Stored in GitHub repository usememos/memos prior to 0.9.1.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-4865
https://github.com/usememos/memos/commit/7670c9536000bb32c6345d4906a91268dcddd5fc
https://huntr.dev/bount…
Cross-site Scripting (XSS) – Stored in GitHub repository usememos/memos prior to 0.9.1.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-4866
https://github.com/usememos/memos/commit/7670c9536000bb32c6345d4906a91268dcddd5fc
https://huntr.dev/bount…
An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authenti…
Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-4864
https://github.com/froxlor/froxlor/commit/f2485ecd9aab8da544b5e12891d82ae6fcff5fc7
https://huntr.dev/bounties/b7140…
In function Table::as_ref, a reference of vector is force cast to slice. There are multiple problems here:
To guarantee the size is correct, we have to first do Vec::shrink_to_fit. The function requires a mutable reference, so we have to force cast fr…
Impact
A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below, and aws-efs-csi-driver versions v1.4.7 and below. When using TLS to mount file systems, the mount helper allocates a local port f…
When hyper-staticfile performs a redirect for a directory request (e.g. a request for /dir that redirects to /dir/), the Location header value was derived from user input (the request path), simply appending a slash. The intent was to perform an origin…
Impact
The XSS vulnerability allows authenticated users to upload .html files. With that, an attacker could execute client side scripts if another user opened a link, such as:
https://push.example.org/image/[alphanumeric string].html
An attacker could…
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos 0.9.0 and prior.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-4848
https://github.com/usememos/memos/commit/c9bb2b785dc5852655405d5c9ab127a2d5aa3948…
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos 0.9.0 and prior.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-4850
https://github.com/usememos/memos/commit/c9bb2b785dc5852655405d5c9ab127a2d5aa3948
https://huntr.dev/bounti…
