Alfresco

Records21All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

Alfresco records in CISA KEV

No Alfresco vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Alfresco 13 records MEDIUM Alfresco Content Services 2 records MEDIUM Reset Password 2 records MEDIUM Alfresco Transform Services 1 record LOW Community Edition 1 record LOW Community Share 1 record LOW Share 1 record LOW

Records

13 records in Alfresco · all components

TI-2019-10584 CVE-2019-14222 · GHSA-63jc-fcpm-hjjw

An issue was discovered in Alfresco Community Edition versions 6.0 and lower.

MEDIUM 47

An issue was discovered in Alfresco Community Edition versions 6.0 and lower.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02932 Published 2019-09-05 No fix listed CWE-1188

TI-2019-11666 CVE-2019-15566 · GHSA-f528-892h-rxcw

The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.

MEDIUM 45

The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01609 Published 2019-08-26 No fix listed CWE-89

TI-2019-10586 CVE-2019-14224 · GHSA-whfv-2c4g-wx2g

An issue was discovered in Alfresco Community Edition 5.2 201707.

MEDIUM 40

An issue was discovered in Alfresco Community Edition 5.2 201707.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.05128 Published 2019-09-05 No fix listed CWE-502

TI-2019-10585 CVE-2019-14223 · GHSA-r489-wv9g-p54f

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and…

LOW 35

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04474 Published 2019-09-06 No fix listed CWE-601

TI-2014-07546 CVE-2014-9301 · GHSA-747c-3wrr-q63m

Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco…

LOW 35

Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbi…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.03927 Published 2014-12-07 No fix listed

TI-2014-07545 CVE-2014-9300 · GHSA-3fjj-qfv3-f9fj

Cross-site request forgery (CSRF) vulnerability in the cmisbrowser servlet in Content…

LOW 31

Cross-site request forgery (CSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition before 5.0.a allows remote attackers to hijack the authentica…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00628 Published 2014-12-07 No fix listed CWE-352

TI-2020-07038 CVE-2020-8777 · GHSA-p3vq-v25w-6m97

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has…

LOW 30

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0317 Published 2020-03-02 No fix listed CWE-79

TI-2020-13368 CVE-2020-18327 · GHSA-r82g-4j97-fq26

Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition…

LOW 29

Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00866 Published 2022-03-04 No fix listed CWE-79

TI-2020-07039 CVE-2020-8778 · GHSA-3wq2-f93g-wx78

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has…

LOW 29

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02621 Published 2020-03-02 No fix listed CWE-79

TI-2020-07037 CVE-2020-8776 · GHSA-3pw8-m4pc-4r7g

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has…

LOW 29

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02676 Published 2020-03-02 No fix listed CWE-79

TI-2015-02977 CVE-2015-3366 · GHSA-fh6j-89x6-p2jw

Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for…

LOW 27

Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete an alfresco node via unspe…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.00643 Published 2015-04-21 No fix listed CWE-352

TI-2019-14045 CVE-2019-19496 · GHSA-r9vr-wvw6-c8v5

Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.

LOW 25

Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00602 Published 2019-12-02 No fix listed CWE-79

TI-2014-02355 CVE-2014-2939 · GHSA-rm67-pq9p-r79c

Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1) an XHTML document, (2) a <% tag, or (3) the taskId paramete…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01012 Published 2014-06-02 No fix listed CWE-79

Open these records in search →