Leanote

Records9All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Leanote records in CISA KEV

No Leanote vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Leanote 7 records MEDIUM Desktop 2 records LOW

Records

9 records

TI-2020-15992 CVE-2020-26158 · GHSA-v78j-8xxm-8wgf

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the…

MEDIUM 45

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01913 Published 2020-09-30 No fix listed CWE-79

TI-2020-15991 CVE-2020-26157 · GHSA-pcw2-q3mm-wc8g

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during…

MEDIUM 45

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01913 Published 2020-09-30 No fix listed CWE-79

TI-2021-19542 CVE-2021-43721 · GHSA-8mh9-7j76-5m8p

Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note.

LOW 29

Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01061 Published 2022-03-28 No fix listed CWE-79

TI-2018-13119 CVE-2018-18553 · GHSA-h839-88jf-jx3g

Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.

LOW 29

Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00865 Published 2018-10-22 No fix listed CWE-79

TI-2017-14701 CVE-2017-1000492 · GHSA-x924-v85r-46p5

Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration

LOW 29

Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01044 Published 2018-01-03 No fix listed CWE-79

TI-2017-14670 CVE-2017-1000459 · GHSA-w5wv-gp3f-2868

Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes

LOW 29

Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00836 Published 2018-01-03 No fix listed CWE-79

TI-2021-03121 CVE-2021-4263 · GHSA-6cmv-2548-82v4

leanote history.js define cross site scripting

LOW 28

A vulnerability, which was classified as problematic, has been found in leanote 2.6.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00563 Published 2022-12-21 No fix listed CWE-79

TI-2019-15945 CVE-2019-1010003 · GHSA-2vjx-rcxr-r2p5

Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).

LOW 28

Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00624 Published 2019-07-11 No fix listed CWE-79

TI-2024-00784 CVE-2024-0849 · GHSA-rpw7-c5cp-v8vp

Leanote 2.7.0 - Local File Read

LOW 24

Leanote version 2.7.0 allows obtaining arbitrary local files.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00234 Published 2024-02-07 No fix listed CWE-22

Open these records in search →

Critical	2
High	0
Medium	7
Low	0
No CVSS	0