68 matches found
CVE-2019-14224
CVE-2019-14224: Alfresco Community에서의 인증된 원격 코드 실행 Alfresco Software 애플리케이션의 여러 구성 요소를 활용하여, 공격자가 원격 코드 실행을 달성할 수 있게 하는 익스플로잇 체인이 관찰되었습니다. 공격자는 Alfresco를 사용하여 다음을 수행해야 합니다: 악성 Solr 구성 파일을 알려진/발견 가능한 위치에 업로드 피해자에서 공격자로의 JMX 연결을 트리거하는 Solr Core 생성 역직렬화 및 코드 실행을 유발하는 악성 Java 객체를 전송할 악성 RMI 서버 호스팅 NV...
CVE-2023-49964
CVE-2023-49964: Alfresco의 FreeMarker 서버 측 템플릿 주입 Hyland Alfresco Community Edition =7.2.0에서 문제가 발견되었습니다. folder.get.html.ftl 파일에 악성 콘텐츠를 삽입함으로써 공격자는 SSTI서버 측 템플릿 주입 공격을 수행할 수 있으며, 이를 통해 FreeMarker 노출 객체를 활용하여 제한을 우회하고 RCE원격 코드 실행를 달성할 수 있습니다. 참고: 이 문제는 CVE-2020-12873에 대한 불완전한 수정으로 인해 존재합니다. NVD 공...
CVE-2019-14222
CVE-2019-14222: Сертификат по умолчанию в Alfresco Community Alfresco Community 5.x и ниже поставляется по умолчанию с набором известных частных сертификатов. Любой, кто загружает и устанавливает программное обеспечение Alfresco Community на локальную машину, получает доступ к этим файлам. После...
EUVD-2020-10251
Malware in sbrugna...
EUVD-2019-5471
Malware in sbrugna...
EUVD-2019-5469
Malware in sbrugna...
EUVD-2014-9126
Malware in sbrugna...
EUVD-2020-29624
Malware in sbrugna...
EUVD-2014-9127
Malware in sbrugna...
CVE-2025-0557
A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2. This affects an unknown part of the file /share/s/ of the component URL Handler. The manipulation leads to cross site scripting. It is possible to initiate th...
CVE-2020-8778
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 rb65251d6-b368 has XSS via an uploaded document, when the attacker has write access to a project...
CVE-2020-18327
Cross Site Scripting XSS vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2...
CVE-2014-9302
Server-side request forgery SSRF vulnerability in the cmisbrowser servlet in Content Management Interoperability Service CMIS in Alfresco Community Edition 5.0.a and earlier allows remote attackers to trigger outbound requests via a crafted URI in the url parameter...
CVE-2014-9301
Server-side request forgery SSRF vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter...
CVE-2019-14222
An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Solr Web Admin Interface. The vulnerability is due to the presence of a default private key that is present in all default installations. An attacker...
CVE-2019-14224
An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Software applications, an exploit chain was observed that allows an attacker to achieve remote code execution on the victim machine. The attacker must upload malicious Solr...
CVE-2019-14223
An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share application is vulnerable to an Open Redirect attack via a crafted POST request. By manipulating the POST parameters, an attacker can redirect a victim to a malicious website over any...
CVE-2014-9300
Cross-site request forgery CSRF vulnerability in the cmisbrowser servlet in Content Management Interoperability Service CMIS in Alfresco Community Edition before 5.0.a allows remote attackers to hijack the authentication of users for requests that access unauthorized URLs and obtain user...
