my-notes-safe My Notes Safe 5.3 memory allocation

Summaryinfo

A vulnerability classified as problematic has been found in my-notes-safe My Notes Safe 5.3. Affected is an unknown function. This manipulation causes memory allocation. This vulnerability appears as CVE-2021-47971. The attack may be initiated remotely. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in my-notes-safe My Notes Safe 5.3. It has been declared as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a memory allocation vulnerability. The CWE definition for the vulnerability is CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. As an impact it is known to affect availability. The summary by CVE is:

My Notes Safe 5.3 contains a denial of service vulnerability that allows attackers to crash the application by pasting excessively long character strings into note fields. Attackers can generate a payload containing 350000 repeated characters and paste it twice into a new note to trigger an application crash.

The weakness was presented by Geovanni Ruiz as 49954. It is possible to read the advisory at exploit-db.com. This vulnerability is known as CVE-2021-47971 since 05/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are unknown but a public exploit is available.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• my-notes-safe

Name

• My Notes Safe

Version

• 5.3

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion