laurent 22 vulnerabilities

Products

• joplin 3

Latest laurent 22 CVEs

Newest publication first

1. CVE-2024-53268 Lack of validation on openExternal allows 1 click remote code execution in joplin

   Published 2024-11-25

   High·CVSS 8.8 EPSS 0.77%

   Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are able to abuse the fact that openExternal is used without any filtering of URI schemes to obtain remote code execution in...

2. CVE-2023-37898 Safe mode Cross-site Scripting (XSS) vulnerability in Joplin

   Published 2024-06-21

   Medium·CVSS 5.4 EPSS 0.43%

   Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows an untrusted note opened in safe mode to execute arbitrary code. packages/renderer/MarkupToHtml.ts renders note content in safe mode by surrounding it with <pre> and...

3. CVE-2023-45673 Arbitrary code execution on click of PDF links in Joplin

   Published 2024-06-21

   Critical·CVSS 9.0 EPSS 1.0%

   Joplin is a free, open source note taking and to-do application. A remote code execution (RCE) vulnerability in affected versions allows clicking on a link in a PDF in an untrusted note to execute arbitrary shell commands. Clicking links in PDFs allows for arbitrary code executio...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.