CVE-2024-5142

XSS in Hubshare's social module

Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

Hubshare

CVE-2024-4056

Denial of service condition in M-Files Server

Denial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume computing resources.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2024-10127

Support for authentication bypass condition in M-Files LDAP authentication

Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a password when the LDAP server itself had the vulnerable configuration.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files M-files Server

CVE-2024-10126

Local file inclusion vulnerability in M-Files Server

Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read server local files of a limited set of filetypes via document preview.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2024-0563

Denial of service condition in M-Files Server

Denial of service condition in M-Files Server in versions before 24.2 (excluding 23.2 SR7 and 23.8 SR5) allows anonymous user to cause denial of service against other anonymous users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2023-6912

Brute force vulnerability in M-Files user authentication

Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2023-6910

Uncontrolled Resource Consumption in M-Files Server

A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2023-6239

Incorrect calculation of effective permissions

Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2023-6189

Improper Permission Handling in M-Files Server

Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2023-6117

M-Files REST API allows Denial of Service

A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2023-5524

M-Files Web Companion allows Remote Code Execution for some filetypes

Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

Web Companion

CVE-2023-5523

M-Files Web Companion allows Remote Code Execution

Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

Web Companion

CVE-2023-4479

Stored XSS Vulnerability in M-Files Web

Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document within limited time period.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files

CVE-2023-3425

CVE-2023-3425: Out-of-Bounds memory read

Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

M-files

Products

Classic Web

CVE-2023-3406

Path traversal issue in M-Files Classic Web

Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

Classic Web

CVE-2023-3405

Denial of service condition in M-Files Server

Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2023-2480

Elevation of Privilege in M-Files Desktop Client

Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files

CVE-2023-2325

Stored XSS Vulnerability in M-Files Classic Web

Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

M-files

Products

Classic Web

CVE-2023-2112

Desktop component allows lateral movement between sessions

Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server

CVE-2023-0384

Uncontrolled Resource Consuption in M-Files Server

User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

M-files

Products

M-files Server