Login Request a demo
AL
Product
Alfresco
by Alfresco · last CVE Mar 4, 2022
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 2High 1Medium 6Low 0
Severity
All severities13Critical2High1Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Alfresco to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2019-14222
9.8
3%
Sep 5
An issue was discovered in Alfresco Community Edition versions 6.0 and lower
Affected: through 6.0
CVE-2019-15566
9.8
2%
Aug 26
The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java
Affected: before 1.8.7
CVE-2019-14224
7.2
5%
Sep 5
An issue was discovered in Alfresco Community Edition 5.2 201707
Affected: 5.2
CVE-2020-18327
6.1
1%
Mar 4
Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API
Affected: 5.2
CVE-2019-14223
6.1
4%
Sep 6
An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N
Affected: before 5.2.6; 6.0; 6.1
CVE-2020-8778
5.4
3%
Mar 2
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project
Affected: before 5.2.7; before 6.2.0
CVE-2020-8777
5.4
3%
Mar 2
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document
Affected: before 5.2.7; before 6.2.0
CVE-2020-8776
5.4
3%
Mar 2
Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file
Affected: before 5.2.7; before 6.2.0
CVE-2019-19496
5.4
1%
Dec 2
Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document
Affected: before 5.2.5
CVE-2015-3366
–
1%
Apr 21
Cross-site request forgery (CSRF) vulnerability in the Alfresco module before 6.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for…
Affected: through 6.x-1.2
CVE-2014-9301
–
4%
Dec 7
Server-side request forgery (SSRF) vulnerability in the proxy servlet in Alfresco Community Edition before 5.0.a allows remote attackers to trigger outbound requests to intranet…
Affected: through 4.2.f
CVE-2014-9300
–
1%
Dec 7
Cross-site request forgery (CSRF) vulnerability in the cmisbrowser servlet in Content Management Interoperability Service (CMIS) in Alfresco Community Edition before 5.0.a allows…
Affected: through 5.0.a
CVE-2014-2939
–
1%
Jun 2
Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1) an XHTML document,…
Affected: through 4.1.6
Showing 13