CVE-2022-38339

CVE-2022-38339 concerns Safe Software FME Server, with a reported cross-site scripting (XSS) vulnerability on the login page. Affected versions include v2021.2.5, v2022.0.0.2 and earlier (per multiple sources in the connected set). The root cause is an XSS flaw that permits execution of arbitrary...

CVE-2022-38342

CVE-2022-38342 affects Safe Software FME Server: configured versions prior to v2022.0.1.1 (e.g., v2021.2.5 and v2022.0.0.2 and below) contain a XML External Entity (XXE) vulnerability that allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery (SSRF). Root caus...

CVE-2022-38340

CVE-2022-38340 affects Safe Software FME Server; a Path Traversal flaw exists in the fmedataupload component and is described for FME Server versions before a likely fixed point (v2022.0.1.1 per PT-2022-24378 wording). The vulnerability enables uploading files to arbitrary locations on the server...

CVE-2023-35801

Affected software: Safe Software FME Server (prior to 2022.2.5). Vulnerability: directory traversal exposing the ability to bypass validation when editing a network-based resource connection, enabling unauthorized reading and writing of arbitrary files. Requirements/impact: attacker must have a u...