彙總 leanote 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
歷史漏洞主要涉及 跨站腳本與路徑處理缺陷 等問題，部分漏洞可能導致 檔案覆寫，並影響 生產負載與軟體部署 相關場景。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2024-0849 | Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR. | [email protected] | 5.0 | 0.03% | 2024-02-07 | 2026-04-20 |
| CVE-2021-4263 | A vulnerability, which was classified as problematic, has been found in leanote 2.6.1. This issue affects the function define of the file public/js/plugins/history.js. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 0f9733c890077942150696dcc6d2b1482b7a0a19. It is recommended to apply a patch to fix this issue. The identifier VDB-216461 was assigned to this vulnerability. | [email protected] | 3.5 | 0.24% | 2022-12-21 | 2024-11-21 |
| CVE-2021-43721 | Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();> | [email protected] | 6.1 | 0.43% | 2022-03-28 | 2024-11-21 |
| CVE-2020-26158 | Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration. | [email protected] | 9.6 | 1.27% | 2020-09-30 | 2024-11-21 |
| CVE-2020-26157 | Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration. | [email protected] | 9.6 | 1.27% | 2020-09-30 | 2024-11-21 |
| CVE-2019-1010003 | Leanote prior to version 2.6 is affected by: Cross Site Scripting (XSS). | [email protected] | 6.1 | 0.21% | 2019-07-11 | 2024-11-21 |
| CVE-2018-18553 | Leanote 2.6.1 has XSS via the Blog Basic Setting title field, which is mishandled during rendering of the "likes" page. | [email protected] | 6.1 | 0.24% | 2018-10-22 | 2024-11-21 |
| CVE-2017-1000492 | Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration | [email protected] | 6.1 | 0.37% | 2018-01-03 | 2024-11-21 |
| CVE-2017-1000459 | Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes | [email protected] | 6.1 | 0.24% | 2018-01-03 | 2024-11-21 |