CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords. |
| 20/12/2023 |
| CVE-2023-6910 | MOYENNE6.5 | A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests. | 20/12/2023 |
| CVE-2023-6239 | ÉLEVÉE8.8 | Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object. | 28/11/2023 |
| CVE-2023-6189 | MOYENNE5.3 | Missing access permissions checks
in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export
jobs using the M-Files API methods. | 22/11/2023 |
| CVE-2023-6117 | ÉLEVÉE7.5 | A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server
before 23.11.13156.0 which allows attackers to execute DoS attacks. | 22/11/2023 |
| CVE-2023-5524 | ÉLEVÉE7.3 | Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows
Remote Code Execution
via specific file types | 20/10/2023 |
| CVE-2023-5523 | ÉLEVÉE7.8 | Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows
Remote Code Execution | 20/10/2023 |
| CVE-2023-2325 | MOYENNE5.4 | Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document. | 20/10/2023 |
| CVE-2023-3425 | MOYENNE5.3 | Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory. | 25/08/2023 |
| CVE-2023-3406 | MOYENNE6.5 | Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server | 25/08/2023 |
| CVE-2023-3405 | ÉLEVÉE7.5 | Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service | 27/06/2023 |
| CVE-2023-2480 | ÉLEVÉE7.8 | Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications | 25/05/2023 |
| CVE-2023-2112 | ÉLEVÉE7.8 | Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0. | 20/04/2023 |
| CVE-2023-0384 | ÉLEVÉE7.5 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1
due to uncontrolled memory consumption for a scheduled job. | 20/04/2023 |
| CVE-2023-0383 | ÉLEVÉE7.5 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1
due to uncontrolled memory consumption. | 20/04/2023 |
| CVE-2023-0382 | MOYENNE6.5 | User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1
due to uncontrolled memory consumption. | 05/04/2023 |
| CVE-2023-0213 | ÉLEVÉE7.8 | Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking. | 29/03/2023 |