Vulnerabilidades de Claris
CVEs publicadas que afetam produtos de Claris: 6 registro(s), com severidade, exploração e correções.
CVE-2026-43685
Alta · 7.2
CWE-78 12/05/2026
OS Command Injection em Claris Filemaker Cloud
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to inject arbitrary operating system commands through unsanitized input in the External ODBC Data Source connection test feature. This issue is fixed in FileMaker Cloud 2.22.0.5.
CVE-2026-43680
Alta · 7.2
CWE-94 12/05/2026
Code Injection em Claris Filemaker Cloud
A Remote Code Execution vulnerability in Claris FileMaker Cloud allowed a user with Admin Console privileges to bypass a front-end restriction on OS Script schedule types and execute arbitrary operating system commands on the underlying host. This issue is fixed in FileMaker Cloud 2.22.0.5.
CVE-2025-46320
Média · 6.1
CWE-79 24/02/2026
Cross-site Scripting (XSS) em Claris Filemaker Server
A cross-site scripting (XSS) vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7.
CVE-2025-46296
Média · 5.4
CWE-285 16/12/2025
Improper Authorization em Claris Filemaker Server
An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features such as viewing license details and downloading application logs. This vulnerability has been fully addressed in FileMaker Server 22.0.4.
CVE-2025-46295
Crítica · 9.8
CWE-94 16/12/2025
Code Injection em Claris Filemaker Server
Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like executing commands or accessing external resources, an attacker could potentially achieve remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4.
CVE-2025-46294
Média · 5.3
CWE-200 16/12/2025
Exposure of Sensitive Information em Claris Filemaker Server
To enhance security, the FileMaker Server 22.0.4 installer now includes an option to disable IIS short filename enumeration by setting NtfsDisable8dot3NameCreation in the Windows registry. This prevents attackers from using the tilde character to discover hidden files and directories. This vulnerability has been fully addressed in FileMaker Server 22.0.4. The IIS Shortname Vulnerability exploits how Microsoft IIS handles legacy 8.3 short filenames, allowing attackers to infer the existence of files or directories by crafting requests with the tilde (~) character.