leanote 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に vendor risk cross-site scripting and パス処理の欠陥 などに関し、一部は ファイル上書き を招き、vendor surface production workloads and vendor surface software deployment 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-0849 | Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR. | [email protected] | 5.0 | 0.23% | 2024-02-07 | 2026-04-20 |
| CVE-2021-4263 | A vulnerability, which was classified as problematic, has been found in leanote 2.6.1. This issue affects the function define of the file public/js/plugins/history.js. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 0f9733c890077942150696dcc6d2b1482b7a0a19. It is recommended to apply a patch to fix this issue. The identifier VDB-216461 was assigned to this vulnerability. | [email protected] | 3.5 | 0.52% | 2022-12-21 | 2024-11-21 |
| CVE-2021-43721 | Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();> | [email protected] | 6.1 | 0.99% | 2022-03-28 | 2024-11-21 |
| CVE-2020-26158 | Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration. | [email protected] | 9.6 | 1.83% | 2020-09-30 | 2024-11-21 |
| CVE-2020-26157 | Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration. | [email protected] | 9.6 | 1.83% | 2020-09-30 | 2024-11-21 |
| CVE-2019-1010003 | Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). | [email protected] | 6.1 | 0.64% | 2019-07-11 | 2024-11-21 |
| CVE-2018-18553 | Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page. | [email protected] | 6.1 | 0.86% | 2018-10-22 | 2024-11-21 |
| CVE-2017-1000492 | Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration | [email protected] | 6.1 | 1.04% | 2018-01-03 | 2024-11-21 |
| CVE-2017-1000459 | Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes | [email protected] | 6.1 | 0.84% | 2018-01-03 | 2024-11-21 |