CVE-2022-24309

Summary: CVE-2022-24309 affects Mendix Runtime (V7 < 7.23.29, V8 < 8.18.16, V9

CVE-2022-25650

CVE-2022-25650 affects Mendix-based deployments of Siemens/Mendix: Project versions 7 (before 7.23.27), 8 (before 8.18.14), 9 (before 9.12.0), and 9.6 (before 9.6.3). The issue arises when querying the database and sorting on a protected field, enabling an authenticated attacker to extract inform...

CVE-2022-26317

The CVE-2022-26317 issue affects Mendix Applications running on Mendix 7, specifically all versions prior to 7.23.29. The root cause is that when returning the result of a completed Microflow execution call, the framework does not properly verify whether the request was initially made by the user...

CVE-2022-27241

Mendix CVE-2022-27241 affects Mendix applications built on versions: 7 (all < 7.23.31), 8 (all < 8.18.18), 9 (all < 9.11), and 9.6 (all

CVE-2022-31257

The CVE-2022-31257 issue affects Mendix-based applications: Mendix 7 (before 7.23.31), Mendix 8 (before 8.18.18), and Mendix 9 (before 9.14.0, including 9.12 before 9.12.2 and 9.6 before 9.6.12). The root cause is an improper access control that allows bypassing password validations when an activ...

CVE-2022-34466

CVE-2022-34466: A Mendix expression-injection vulnerability in the Workflow subsystem of Mendix Runtime affects Mendix 9 deployments. Affected are Mendix 9 versions 9.11–9.15 and 9.12 before 9.12.3. The issue could allow a malicious user to leak sensitive information in certain configurations. Re...