Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: MyComplianceOffice Component: Mycomplianceoffice Clear all filters
TI-2026-38885 CVE-2026-53909 · GHSA-5v97-p7p8-r448

Arbitrary File Upload in MCO

Priority LOW 24

MCO does not correctly validate types of uploaded files.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00394 Published 2026-07-01 No fix listed CWE-434
TI-2026-38884 CVE-2026-53908 · GHSA-59mp-p3m2-6wr7

User Enumeration in MCO

Priority LOW 36

MCO is vulnerable to User Enumeration through authentication-related functionalities.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00361 Published 2026-07-01 No fix listed CWE-204
TI-2026-38883 CVE-2026-53907 · GHSA-r38x-66p9-p239

Stored Cross‑Site Scripting in MCO

Priority LOW 22

MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00241 Published 2026-07-01 No fix listed CWE-79
TI-2026-38882 CVE-2026-53906 · GHSA-qwcf-5293-mm28

Path Disclosure and Path Traversal in MCO

Priority LOW 24

MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0052 Published 2026-07-01 No fix listed CWE-209
TI-2026-38881 CVE-2026-53905 · GHSA-4hjp-j24w-p3rr

Unauthorized Access to Administrator ACL View in MCO

Priority LOW 24

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00317 Published 2026-07-01 No fix listed CWE-863
TI-2026-38879 CVE-2026-53903 · GHSA-h63w-8j45-g3cx

Insecure Direct Object Reference in MCO

Priority LOW 24

MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00407 Published 2026-07-01 No fix listed CWE-639
TI-2026-38878 CVE-2026-53902 · GHSA-rgv6-j8h9-46fv

Privilege Escalation in MCO

Priority LOW 31

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00342 Published 2026-07-01 No fix listed CWE-266