CVE-2021-41808

In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default...

M-Files Web 和 M-Files Server 安全漏洞

M-Files Corporation M-Files Web is an intelligent information management platform from M-Files Corporation, USA. M-Files Server is a server for the M-Files system from M-Files Corporation. A security vulnerability exists in the M-Files Server and M-Files Web products versions lower than...

M-Files Server 代码问题漏洞

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in M-Files Server products prior to version 22.1.11017.1, which stems from a preview feature that allows querying from the server for certain document types that reference external entities...

PT-2022-11489

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 22.1.11017.1 Description The issue concerns a Server-Side Request Forgery SSRF vulnerability. It is related to a preview function in M-Files Server products that allows making queries from the server with certa...

CVE-2021-41807: Improper Restriction of Excessive Authentication Attempts

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier...

CVE-2022-23305: Improper Neutralization of Special Elements used in an SQL Command

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings...

PT-2022-11488

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 21.11.10775.0 Description The issue concerns the logging of Federated authentication to the event log in the M-Files Server product, where sensitive information is written to the log when this feature is enable...

CVE-2021-41809: Server-Side Request Forgery (SSRF)

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities...

PT-2022-11487

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 21.12.10873.0 M-Files Web versions prior to 21.12.10873.0 Description The issue is related to a lack of rate limiting in certain types of user accounts, which allows for an unlimited number of attempts, making ...

M-Files Server 日志信息泄露漏洞

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in versions of the M-Files Server product prior to 21.11.10775.0 that stems from logging with federated authentication enabled writing sensitive information to the event log...

CVE-2021-41808: Insertion of Sensitive Information into Log File

In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default...

CVE-2021-41809

SSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, in a preview function allowed making queries from the server with certain document types referencing external entities...

CVE-2021-41807

Lack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0 in certain type of user accounts allows unlimited amount of attempts and therefore makes brute-forcing login accounts easier...

CVE-2021-40327

Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...

CVE-2021-40327

Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...

CVE-2021-40327

Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...

CVE-2021-40327

Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...

Authorization

Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...

UBUNTU-CVE-2021-40327

Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...

CVE-2021-40327

Trusted Firmware-M TF-M 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key held by the Crypto service based solely on knowledge of its key ID. For example, there is no authorization check associated with the relationship between a caller and a key owner...