Evernote records
12 published records for vendor evernote.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')4
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2
- CWE-287 Improper Authentication2
- CWE-426 Untrusted Search Path1
- CWE-732 Incorrect Permission Assignment for Critical Resource1
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')1
The weakness classes this vendor ships most often: where to look.
CWEBug bounty scope
The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.
All records
12 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2023-50643Proof of concept | An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspevernote · evernote | Critical9.8 | — | 1.6% | Jan 8, 2024 |
36Monitor | CVE-2020-17759No exploit | An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler.evernote · evernote · CWE-77 | High8.8 | — | 3.4% | Jun 24, 2021 |
31Monitor | CVE-2019-17051No exploit | Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demonevernote · evernote · CWE-732 | High7.8 | — | 1.6% | Sep 30, 2019 |
31Monitor | CVE-2016-4900No exploit | Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan hoevernote · evernote · CWE-426 | High7.8 | — | 1.5% | May 22, 2017 |
31Monitor | CVE-2019-10038Proof of concept | Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applicevernote · evernote · CWE-22 | High7.8 | — | 1.3% | May 31, 2019 |
30Monitor | CVE-2018-20058No exploit | In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634.evernote · evernote · CWE-22 | High7.5 | — | 1.4% | Dec 11, 2018 |
28Monitor | CVE-2013-5116No exploit | Evernote prior to 5.5.1 has insecure password changeevernote · evernote · CWE-287 | High7.1 | — | 0.4% | Jan 31, 2020 |
25Monitor | CVE-2018-18524No exploit | Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability.evernote · evernote · CWE-79 | Medium6.1 | — | 1.9% | May 13, 2019 |
24Monitor | CVE-2019-12592No exploit | A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackersevernote · web clipper · CWE-79 | Medium6.1 | — | 1.0% | Jun 18, 2019 |
24Monitor | CVE-2018-20351No exploit | The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.evernote · evernote · CWE-79 | Medium6.1 | — | 0.6% | Dec 21, 2018 |
21Monitor | CVE-2018-19658No exploit | The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS.evernote · yinxiang biji · CWE-79 | Medium5.4 | — | 0.5% | Mar 2, 2020 |
18Monitor | CVE-2013-5112No exploit | Evernote before 5.5.1 has insecure PIN storageevernote · evernote · CWE-287 | Medium4.6 | — | 0.5% | Jan 31, 2020 |
- CVE-2023-5064340Plan
An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnsp
CriticalCVSS 9.8Proof of conceptEPSS 1%evernote · evernoteJan 8, 2024
- CVE-2020-1775936Monitor
An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler.
HighCVSS 8.8No exploitEPSS 3%evernote · evernoteJun 24, 2021
- CVE-2019-1705131Monitor
Evernote before 7.13 GA on macOS allows code execution because the com.apple.quarantine attribute is not used for attachment files, as demon
HighCVSS 7.8No exploitEPSS 1%evernote · evernoteSep 30, 2019
- CVE-2016-490031Monitor
Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan ho
HighCVSS 7.8No exploitEPSS 1%evernote · evernoteMay 22, 2017
- CVE-2019-1003831Monitor
Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applic
HighCVSS 7.8Proof of conceptEPSS 1%evernote · evernoteMay 31, 2019
- CVE-2018-2005830Monitor
In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634.
HighCVSS 7.5No exploitEPSS 1%evernote · evernoteDec 11, 2018
- CVE-2013-511628Monitor
Evernote prior to 5.5.1 has insecure password change
HighCVSS 7.1No exploitEPSS 0%evernote · evernoteJan 31, 2020
- CVE-2018-1852425Monitor
Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability.
MediumCVSS 6.1No exploitEPSS 1%evernote · evernoteMay 13, 2019
- CVE-2019-1259224Monitor
A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web Clipper extension before 7.11.1 for Chrome allows remote attackers
MediumCVSS 6.1No exploitEPSS 1%evernote · web clipperJun 18, 2019
- CVE-2018-2035124Monitor
The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS, aka MAC-832.
MediumCVSS 6.1No exploitEPSS 0%evernote · evernoteDec 21, 2018
- CVE-2018-1965821Monitor
The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS.
MediumCVSS 5.4No exploitEPSS 0%evernote · yinxiang bijiMar 2, 2020
- CVE-2013-511218Monitor
Evernote before 5.5.1 has insecure PIN storage
MediumCVSS 4.6No exploitEPSS 0%evernote · evernoteJan 31, 2020