Vendors / siyuan-note Records 243 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 67
CVSS high 89
Exploited now siyuan-note records in CISA KEV No siyuan-note vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 76
An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01169 · Published 2024-02-05 · No fix listed CWE-77
Priority MEDIUM 46
b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02084 · Published 2018-04-27 · No fix listed CWE-434
Priority LOW 29
b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00818 · Published 2019-10-10 · No fix listed CWE-79
Priority LOW 29
An issue was discovered in b3log Symphony (aka Sym) before v3.4.7.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00802 · Published 2019-02-25 · Fixed in 3.4.7 CWE-79
Priority LOW 25
b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/us…
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00479 · Published 2017-11-15 · No fix listed CWE-79
Priority LOW 23
In Symphony before 3.3.0, there is XSS in the Title under Post.
CVSS 3.0 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00524 · Published 2019-06-20 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
67 89 85 2 0
THREATIST.IORead the docs