Export limit exceeded: 425803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 45

Export CSV
CVE-2023-6910

Uncontrolled Resource Consumption in M-Files Server

A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2023-6239

Incorrect calculation of effective permissions

Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2023-6189

Improper Permission Handling in M-Files Server

Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2023-6117

M-Files REST API allows Denial of Service

A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2023-4479

Stored XSS Vulnerability in M-Files Web

Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document within limited time period.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files
CVE-2023-3405

Denial of service condition in M-Files Server

Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2023-2480

Elevation of Privilege in M-Files Desktop Client

Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files
CVE-2023-2112

Desktop component allows lateral movement between sessions

Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2023-0384

Uncontrolled Resource Consuption in M-Files Server

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2023-0383

Uncontrolled Resource Consuption in M-Files Server

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2023-0382

Uncontrolled Resource Consumption in M-Files Server

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2023-0213

Local Elevation of Privilege in M-Files

Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
M-files Microsoft
Products
M-files Windows
CVE-2022-4862

XSS vulnerability in M-Files Web

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2022-4861

Incorrect Implementation of Authentication Algorithm

Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Client
CVE-2022-4858

Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2022-4270

Incorrect privilege assignment in M-Files Web Server

Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally.

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2022-1911

Information disclosure in M-Files Server

Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the underlying operating system.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2022-4264

Incorrect privilege assignment in M-Files Web Server

Incorrect Privilege Assignment in M-Files Web (Classic) in M-Files before 22.8.11691.0 allows low privilege user to change some configuration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files
CVE-2022-3284

Insecure way of passing a download key

Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server
CVE-2022-1606

Incorrect privilege assignment in M-Files Server

Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
M-files
Products
M-files Server