Vulnerabilities

TI-2013-03968 CVE-2013-4521 · GHSA-pw96-ph5x-hm7c

Deserialization of untrusted data in Nuxeo Platform

MEDIUM 49

RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code v…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04141 Published 2020-02-06 No fix listed CWE-502

TI-2017-03804 CVE-2017-5869 · GHSA-r32w-jwh3-hc96

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1…

MEDIUM 63

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a ..

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.34585 Published 2017-03-24 No fix listed CWE-22

Vulnerabilities

Filters

Deserialization of untrusted data in Nuxeo Platform

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1…