CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0384 – Uncontrolled Resource Consuption in M-Files Server
https://notcve.org/view.php?id=CVE-2023-0384
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption for a scheduled job. • https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0384 https://product.m-files.com/security-advisories/cve-2023-0384 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0383 – Uncontrolled Resource Consuption in M-Files Server
https://notcve.org/view.php?id=CVE-2023-0383
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. • https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0383 https://product.m-files.com/security-advisories/cve-2023-0383 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-0382 – Uncontrolled Resource Consumption in M-Files Server
https://notcve.org/view.php?id=CVE-2023-0382
User-controlled operations could have allowed Denial of Service in M-Files Server before 23.4.12528.1 due to uncontrolled memory consumption. • https://www.m-files.com/about/trust-center/security-advisories/cve-2023-0382 https://product.m-files.com/security-advisories/cve-2023-0382 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4862 – XSS vulnerability in M-Files Web
https://notcve.org/view.php?id=CVE-2022-4862
Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3. • https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4862 https://product.m-files.com/security-advisories/cve-2022-4862 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-3284 – Insecure way of passing a download key
https://notcve.org/view.php?id=CVE-2022-3284
Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0. • https://www.m-files.com/about/trust-center/security-advisories/cve-2022-3284 https://product.m-files.com/security-advisories/cve-2022-3284 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •