CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37298
https://notcve.org/view.php?id=CVE-2023-37298
30 Jun 2023 — Joplin before 2.11.5 allows XSS via a USE element in an SVG document. • https://github.com/laurent22/joplin/commit/caf66068bfc474bbfd505013076ed173cd90ca83 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37299
https://notcve.org/view.php?id=CVE-2023-37299
30 Jun 2023 — Joplin before 2.11.5 allows XSS via an AREA element of an image map. • https://github.com/laurent22/joplin/commit/9e90d9016daf79b5414646a93fd369aedb035071 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45598
https://notcve.org/view.php?id=CVE-2022-45598
31 Jan 2023 — Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization. Una vulnerabilidad de cross site scripting en la aplicación de escritorio Joplin anterior a v2.9.17 permite a un atacante ejecutar código arbitrario mediante una sanitización inadecuada. • https://github.com/laurent22/joplin/commit/a2de167b95debad83a0f0c7925a88c0198db812e • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-33295
https://notcve.org/view.php?id=CVE-2021-33295
16 Jun 2022 — Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en Joplin Desktop App versiones anteriores a 1.8.5, permite a atacantes ejecutar código arbitrario debido a un saneo inapropiado del html • https://github.com/laurent22/joplin/commit/9c20d5947d1fa4678a8b640792ff3d31224f0adf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23340
https://notcve.org/view.php?id=CVE-2022-23340
08 Feb 2022 — Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results. Joplin versión 2.6.10, permite a atacantes remotos ejecutar comandos del sistema mediante código malicioso en los resultados de búsqueda del usuario • https://github.com/laurent22/joplin/issues/6004 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-37916
https://notcve.org/view.php?id=CVE-2021-37916
02 Aug 2021 — Joplin before 2.0.9 allows XSS via button and form in the note body. Joplin versiones anteriores a 2.0.9, permite un ataque XSS por medio del button y form en el cuerpo de la nota • https://github.com/laurent22/joplin/commit/feaecf765368f2c273bea3a9fa641ff0da7e6b26 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2020-28249 – Joplin 1.2.6 - 'link' Cross Site Scripting
https://notcve.org/view.php?id=CVE-2020-28249
06 Nov 2020 — Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. Joplin versión 1.2.6 para Desktop, permite un ataque de tipo XSS por medio de un elemento LINK en una nota • https://www.exploit-db.com/exploits/49024 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 2%CPEs: 1EXPL: 3CVE-2020-15930 – Joplin 1.0.245 - Arbitrary Code Execution (PoC)
https://notcve.org/view.php?id=CVE-2020-15930
24 Sep 2020 — An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. Un problema de tipo XSS en Joplin Desktop versiones 1.0.190 hasta 1.0.245, permite una ejecución de código arbitrario por medio de una etiqueta de inserción HTML maliciosa. Joplin version 1.0.245 suffers from a cross site scripting vulnerability that can lead to allowing for remote code execution. • https://packetstorm.news/files/id/159316 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 5CVE-2020-9038 – Joplin Desktop 1.0.184 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-9038
17 Feb 2020 — Joplin through 1.0.184 allows Arbitrary File Read via XSS. Joplin versiones hasta 1.0.184, permite una Lectura de Archivos Arbitrarios por medio de un ataque de tipo XSS. Joplin Desktop version 1.0.184 suffers from a cross site scripting vulnerability. • https://packetstorm.news/files/id/156582 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-1000534
https://notcve.org/view.php?id=CVE-2018-1000534
26 Jun 2018 — Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here https://github.com/laurent22/joplin/commit/494e235e18659574f836f84fcf9f4d4fcdcfcf89 that can result in executing unauthorized code within the rights in which the application is running. This attack appear to be exploitable via Victim synchronizing notes ... • https://github.com/laurent22/joplin/commit/494e235e18659574f836f84fcf9f4d4fcdcfcf89 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •