M-Files Server vulnerabilities

In M-Files Server versions before 26.5.16015.0, before 26.2 LTS, and before 25.8 LTS SR3, a denial-of-service vulnerability exists. This allows an authenticated user to cause the MFserver process to crash.

Denial-of-service vulnerability in M-Files Server before version 26.5.16015.3 allows an authenticated admin user to crash the server process and prevent it from restarting.

An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.

In M-Files Server before versions 25.11.15392.1, 25.2 LTS SR2, and 25.8 LTS SR2, there is a denial-of-service vulnerability. An authenticated user can cause the MFserver process to crash.

Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.

Unchecked parameter value in M-Files Server in versions before 23.6.12695.3 (excluding 23.2 SR2 and newer) allows anonymous user to cause denial of service.