RSS   Vulnerabilities for 'Alfresco'   RSS

2015-04-21
 
CVE-2015-3366

 

 
Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete an alfresco node via unspecified vectors.

 
2014-12-07
 
CVE-2014-9301

CWE-Other
 

 
Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet servers, conduct port scans, and read arbitrary files via a crafted URI in the endpoint parameter.

 
 
CVE-2014-9300

CWE-352
 

 
Cross-site request forgery (CSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition before 5.0.a allows remote attackers to hijack the authentication of users for requests that access unauthorized URLs and obtain user credentials via a URL in the url parameter.

 
2014-06-02
 
CVE-2014-2939

CWE-79
 

 
Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1) an XHTML document, (2) a <% tag, or (3) the taskId parameter to share/page/task-edit.

 

 >>> Vendor: Alfresco 2 Products
Alfresco
Community edition


Copyright 2017, cxsecurity.com

 

Back to Top