Filtered by vendor Hyland Subscriptions
Filtered by product Alfresco Content Services Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-40347 1 Hyland 1 Alfresco Content Services 2024-08-22 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform 23.2.1-r96 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the parameter htmlid.
CVE-2023-49964 1 Hyland 1 Alfresco Content Services 2024-08-02 8.8 High
An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remote Code Execution). NOTE: this issue exists because of an incomplete fix for CVE-2020-12873.