|Title:||Evernote for Windows Stored Cross-Site Scripting Vulnerability (Windows)|
|Summary:||Evernote for Windows through version 6.16.1 beta is prone to a Stored Cross-Site Scripting vulnerability.|
Evernote for Windows through version 6.16.1 beta is prone to a Stored Cross-Site Scripting vulnerability.
The vulnerability is caused by insufficient data validation. Input that should be handled as data is treated as code
because it does not remove or escape special characters in the filenames of pictures embedded in notes.
Attackers could exploit Evernote notes by embedding code into filenames. When the note is opened, the code will run.
Evernote for Windows - through 6.16.1 beta.
Upgrade to Evernote for Windows version 6.16.1 beta or later.
Common Vulnerability Exposure (CVE) ID: CVE-2018-18524|
|Copyright||Copyright (C) 2018 Greenbone Networks GmbH|
|This is only one of 71225 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.