Vulnerabilities

TI-2023-17889 CVE-2023-35801 · GHSA-p96w-2637-g2qv

A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an…

MEDIUM 40

A directory traversal vulnerability in Safe Software FME Server before 2022.2.5 allows an attacker to bypass validation when editing a network-based resource connection, resulting in the unauthorized reading and writing…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01477 Published 2023-06-23 No fix listed CWE-22

TI-2022-17982 CVE-2022-38340 · GHSA-hvhp-3r57-wcr8

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a…

MEDIUM 42

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01352 Published 2022-09-20 No fix listed CWE-22

TI-2022-17983 CVE-2022-38341 · GHSA-vhfx-73jm-q8gh

Safe Software FME Server v2021.2.5 and below does not employ server-side validation.

LOW 32

Safe Software FME Server v2021.2.5 and below does not employ server-side validation.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00615 Published 2022-09-19 No fix listed

TI-2022-17981 CVE-2022-38339 · GHSA-6p3q-v495-f3jw

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting…

MEDIUM 42

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login…

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00575 Published 2022-09-19 No fix listed CWE-79

TI-2022-17984 CVE-2022-38342 · GHSA-g83j-rjq4-8487

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML…

LOW 38

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attackers to perform data exfiltration or Server-Side Request Forge…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00616 Published 2022-09-13 No fix listed CWE-611

TI-2020-14397 CVE-2020-22789 · GHSA-gfxh-gvwh-3w55

Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote…

LOW 30

Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01244 Published 2021-04-28 No fix listed CWE-79

TI-2020-14398 CVE-2020-22790 · GHSA-q5cx-q7jp-q7h9

Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote…

LOW 27

Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web script or HTML via modifying the name of the users.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01287 Published 2021-04-28 No fix listed CWE-79

TI-2018-14455 CVE-2018-20402 · GHSA-r627-cr47-hvxp

Safe Software FME Server through 2018.1 creates and enables three additional accounts in…

MEDIUM 40

Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01035 Published 2018-12-23 No fix listed CWE-1188

Vulnerabilities

Filters