Filtered by vendor M-files Subscriptions
Total 58 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-10127 1 M-files 2 M-files, M-files Server 2026-02-23 9.8 Critical
Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of OpenLDAP configurations that allowed user authentication without a password when the LDAP server itself had the vulnerable configuration.
CVE-2024-10126 1 M-files 1 M-files Server 2026-02-23 4.3 Medium
Local File Inclusion vulnerability in M-Files Server in versions before 24.11 (excluding 24.8 SR1, 24.2 SR3 and 23.8 SR7) allows an authenticated user to read server local files of a limited set of filetypes via document preview.
CVE-2024-0563 1 M-files 1 M-files Server 2026-02-23 4.3 Medium
Denial of service condition in M-Files Server in versions before 24.2 (excluding 23.2 SR7 and 23.8 SR5) allows anonymous user to cause denial of service against other anonymous users.
CVE-2023-6912 1 M-files 1 M-files Server 2026-02-23 7.5 High
Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.
CVE-2023-6910 1 M-files 1 M-files Server 2026-02-23 6.5 Medium
A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests.
CVE-2023-6239 1 M-files 1 M-files Server 2026-02-23 5.4 Medium
Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of metadata-driven permissions in M-Files Server versions 23.9, 23.10, and 23.11 before 23.11.13168.7, potentially enabling unauthorized access to the object.
CVE-2023-6189 1 M-files 1 M-files Server 2026-02-23 4.3 Medium
Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods.
CVE-2023-6117 1 M-files 1 M-files Server 2026-02-23 5.7 Medium
A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.
CVE-2023-5524 1 M-files 1 Web Companion 2026-02-23 8.2 High
Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution via specific file types
CVE-2023-5523 1 M-files 1 Web Companion 2026-02-23 8.6 High
Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows Remote Code Execution
CVE-2023-4479 1 M-files 1 M-files 2026-02-23 7.3 High
Stored XSS Vulnerability in M-Files Web versions before 23.8 allows attacker to execute script on users browser via stored HTML document within limited time period.
CVE-2023-3425 1 M-files 1 Classic Web 2026-02-23 6.5 Medium
Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.
CVE-2023-3406 1 M-files 1 Classic Web 2026-02-23 7.7 High
Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server
CVE-2023-3405 1 M-files 1 M-files Server 2026-02-23 7.5 High
Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service
CVE-2023-2480 1 M-files 1 M-files 2026-02-23 7.5 High
Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications
CVE-2023-2325 1 M-files 1 Classic Web 2026-02-23 7.3 High
Stored XSS Vulnerability in M-Files Classic Web versions before 23.10 and LTS Service Release Versions before 23.2 LTS SR4 and 23.8 LTS SR1allows attacker to execute script on users browser via stored HTML document.
CVE-2023-2112 1 M-files 1 M-files Server 2026-02-23 3.6 Low
Desktop component service allows lateral movement between sessions in M-Files before 23.4.12455.0.
CVE-2023-0384 1 M-files 1 M-files Server 2026-02-23 6.5 Medium
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job.
CVE-2023-0383 1 M-files 1 M-files Server 2026-02-23 7.5 High
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption.
CVE-2023-0382 1 M-files 1 M-files Server 2026-02-23 6.5 Medium
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption.