CVE-2018-18524 - CVE House
Back to Database
Status published Medium CVE-2018-18524

Evernote 6.15 on Windows has an incorrectly repaired stored XSS...

Vulnerability Description

Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode, the attacker can read the victim's files and achieve remote execution command on the victim's computer.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-18524

Credits & Attribution

No credits recorded in the NVD database.

References

More from evernote

View All →
CVE-2020-17759
An issue was found in the Evernote client for Windows...
High 8.8
CVE-2019-17051
Evernote before 7.13 GA on macOS allows code execution because...
High 7.8
CVE-2019-12592
A universal Cross-site scripting (UXSS) vulnerability in the Evernote Web...
Medium 6.1
CVE-2019-10038
Evernote 7.9 on macOS allows attackers to execute arbitrary programs...
High 7.8
CVE-2018-20351
The Markdown component in Evernote (Chinese) before 8.3.2 on macOS...
Medium 6.1

Affected Vendor

Affected Software

evernote
Vulnerable Versions:
6.15

Timeline

Official Publish: May 13th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.