Vulnerabilities

TI-2022-11815 CVE-2022-29281 · GHSA-47xc-8r2q-5m83

Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files…

MEDIUM 41

Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01578 Published 2022-04-15 No fix listed CWE-22

TI-2022-09627 CVE-2022-26198 · GHSA-3rcq-vwx7-jh65

MEDIUM 45

Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01689 Published 2022-03-26 No fix listed

TI-2020-12842 CVE-2020-16608 · GHSA-636w-6mqg-2rmv

MEDIUM 49

Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true).

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.04527 Published 2020-12-10 No fix listed CWE-79