Show filters
23 Total Results
Displaying 11-20 of 23
Sort by:
Attacker Value
Unknown
CVE-2023-37299
Disclosure Date: June 30, 2023 (last updated February 25, 2025)
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
0
Attacker Value
Unknown
CVE-2023-37298
Disclosure Date: June 30, 2023 (last updated February 25, 2025)
Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
0
Attacker Value
Unknown
CVE-2022-45598
Disclosure Date: January 31, 2023 (last updated February 24, 2025)
Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.
0
Attacker Value
Unknown
CVE-2022-40277
Disclosure Date: September 30, 2022 (last updated February 24, 2025)
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.
0
Attacker Value
Unknown
CVE-2022-35131
Disclosure Date: July 25, 2022 (last updated February 24, 2025)
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
0
Attacker Value
Unknown
CVE-2021-33295
Disclosure Date: June 16, 2022 (last updated February 23, 2025)
Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.
0
Attacker Value
Unknown
CVE-2022-23340
Disclosure Date: February 08, 2022 (last updated October 07, 2023)
Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.
0
Attacker Value
Unknown
CVE-2021-23431
Disclosure Date: August 24, 2021 (last updated February 23, 2025)
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
0
Attacker Value
Unknown
CVE-2021-37916
Disclosure Date: August 03, 2021 (last updated February 23, 2025)
Joplin before 2.0.9 allows XSS via button and form in the note body.
0
Attacker Value
Unknown
CVE-2020-28249
Disclosure Date: November 06, 2020 (last updated February 22, 2025)
Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.
0
