Filtered by vendor Joplinapp Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-49362 1 Joplinapp 1 Joplin 2024-11-15 7.7 High
Joplin is a free, open source note taking and to-do application. Joplin-desktop has a vulnerability that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.
CVE-2024-40643 2 Joplin Project, Joplinapp 2 Joplin, Joplin 2024-09-17 9.7 Critical
Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag.
CVE-2021-23431 1 Joplinapp 1 Joplin 2024-09-17 5.4 Medium
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
CVE-2022-40277 3 Canonical, Joplinapp, Linux 3 Ubuntu Linux, Joplin, Linux Kernel 2024-08-03 7.8 High
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.
CVE-2022-35131 1 Joplinapp 1 Joplin 2024-08-03 9.0 Critical
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.