Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Blinko: multiple interfaces in the comment feature allow unauthorized access
Vulnerability Description
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowing attackers to post comments on any note (including private notes) without authorization, even if the note has not been publicly shared. The /api/v1/comment/list endpoint has the same issue, allowing unauthorized viewing of comments on all notes. This issue has been patched in version 1.8.4.
CVSS Information
N/A
Vulnerability Type
通过用户控制密钥绕过授权机制
Vulnerability Title
Blinko 安全漏洞
Vulnerability Description
Blinko是Blinko开源的一款基于人工智能的卡片式笔记应用，专为想要快速捕捉和整理转瞬即逝的灵感的用户而设计。 Blinko 1.8.4之前版本存在安全漏洞，该漏洞源于/api/v1/comment/create端点存在未经授权的访问，允许攻击者在任何笔记上发布评论，且/api/v1/comment/list端点存在相同问题，允许未经授权查看所有笔记的评论。
CVSS Information
N/A
Vulnerability Type
N/A