Aggregates CVE and security vulnerability intelligence across all leanote-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk cross-site scripting and vendor risk path handling and related problems; some flaws may lead to vendor impact file overwrite, affecting vendor surface production workloads scenarios.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2024-0849 | Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR. | [email protected] | 5.0 | 0.23% | 2024-02-07 | 2026-04-20 |
| CVE-2021-4263 | A vulnerability, which was classified as problematic, has been found in leanote 2.6.1. This issue affects the function define of the file public/js/plugins/history.js. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 0f9733c890077942150696dcc6d2b1482b7a0a19. It is recommended to apply a patch to fix this issue. The identifier VDB-216461 was assigned to this vulnerability. | [email protected] | 3.5 | 0.52% | 2022-12-21 | 2024-11-21 |
| CVE-2021-43721 | Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();> | [email protected] | 6.1 | 0.99% | 2022-03-28 | 2024-11-21 |
| CVE-2020-26158 | Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration. | [email protected] | 9.6 | 1.83% | 2020-09-30 | 2024-11-21 |
| CVE-2020-26157 | Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration. | [email protected] | 9.6 | 1.83% | 2020-09-30 | 2024-11-21 |
| CVE-2019-1010003 | Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). | [email protected] | 6.1 | 0.64% | 2019-07-11 | 2024-11-21 |
| CVE-2018-18553 | Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page. | [email protected] | 6.1 | 0.86% | 2018-10-22 | 2024-11-21 |
| CVE-2017-1000492 | Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration | [email protected] | 6.1 | 1.04% | 2018-01-03 | 2024-11-21 |
| CVE-2017-1000459 | Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes | [email protected] | 6.1 | 0.84% | 2018-01-03 | 2024-11-21 |