Vulnerabilities

TI-2024-00784 CVE-2024-0849 · GHSA-rpw7-c5cp-v8vp

Leanote 2.7.0 - Local File Read

LOW 24

Leanote version 2.7.0 allows obtaining arbitrary local files.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00234 Published 2024-02-07 No fix listed CWE-22

TI-2021-03121 CVE-2021-4263 · GHSA-6cmv-2548-82v4

LOW 28

A vulnerability, which was classified as problematic, has been found in leanote 2.6.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00563 Published 2022-12-21 No fix listed CWE-79

TI-2021-19542 CVE-2021-43721 · GHSA-8mh9-7j76-5m8p

LOW 29

Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01061 Published 2022-03-28 No fix listed CWE-79

TI-2020-15991 CVE-2020-26157 · GHSA-pcw2-q3mm-wc8g

MEDIUM 45

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01913 Published 2020-09-30 No fix listed CWE-79

TI-2020-15992 CVE-2020-26158 · GHSA-v78j-8xxm-8wgf

MEDIUM 45

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01913 Published 2020-09-30 No fix listed CWE-79

TI-2019-15945 CVE-2019-1010003 · GHSA-2vjx-rcxr-r2p5

LOW 28

Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS).

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00624 Published 2019-07-11 No fix listed CWE-79

TI-2018-13119 CVE-2018-18553 · GHSA-h839-88jf-jx3g

LOW 29

Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00865 Published 2018-10-22 No fix listed CWE-79

TI-2017-14701 CVE-2017-1000492 · GHSA-x924-v85r-46p5

LOW 29

Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01044 Published 2018-01-03 No fix listed CWE-79

TI-2017-14670 CVE-2017-1000459 · GHSA-w5wv-gp3f-2868

LOW 29

Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00836 Published 2018-01-03 No fix listed CWE-79