filemaker vulnerabilities

Products

• filemaker 5
• filemaker pro 4
• filemaker pro advanced 4
• filemaker server 1

Latest filemaker CVEs

Newest publication first

1. CVE-2016-1208 The server in Apple FileMaker before 14.0.4 on OS X allows remote attackers to read PHP source code via unspecified vectors.

   Published 2016-05-14

   High·CVSS 7.5

   The server in Apple FileMaker before 14.0.4 on OS X allows remote attackers to read PHP source code via unspecified vectors.

2. CVE-2014-5322 Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 13 and Pro Advanced before 13 allows remote attackers to inject arbitrary web script or HTML via un...

   Published 2014-09-22

   Medium·CVSS 4.3

   Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 13 and Pro Advanced before 13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix f...

3. CVE-2014-5321 FileMaker Pro before 13 and Pro Advanced before 13 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

   Published 2014-09-22

   Medium·CVSS 5.8

   FileMaker Pro before 13 and Pro Advanced before 13 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: this vulnerability exists because of an incorrect fi...

4. CVE-2013-3640 Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 12 and Pro Advanced before 12 allows remote attackers to inject arbitrary web script or HTML via un...

   Published 2013-06-10

   Medium·CVSS 4.3

   Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 12 and Pro Advanced before 12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

5. CVE-2013-2319 FileMaker Pro before 12 and Pro Advanced before 12 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

   Published 2013-06-10

   Medium·CVSS 5.8

   FileMaker Pro before 12 and Pro Advanced before 12 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

6. CVE-2007-6104 Cross-site scripting (XSS) vulnerability in the Instant Web Publishing feature in FileMaker Pro 7 and 8, Server 7 and 8, and Developer 7 allows remote attackers to inject arbitrary web script or HTML....

   Published 2007-11-23

   Medium·CVSS 4.3

   Cross-site scripting (XSS) vulnerability in the Instant Web Publishing feature in FileMaker Pro 7 and 8, Server 7 and 8, and Developer 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

7. CVE-2000-0386 FileMaker Pro 5 Web Companion allows remote attackers to send anonymous or forged email.

   Published 2000-06-15

   High·CVSS 7.5 EPSS 1.4%

   FileMaker Pro 5 Web Companion allows remote attackers to send anonymous or forged email.

8. CVE-2000-0385 FileMaker Pro 5 Web Companion allows remote attackers to bypass Field-Level database security restrictions via the XML publishing or email capabilities.

   Published 2000-06-15

   Medium·CVSS 5.0 EPSS 1.6%

   FileMaker Pro 5 Web Companion allows remote attackers to bypass Field-Level database security restrictions via the XML publishing or email capabilities.

9. CVE-2000-0123 The shopping cart application provided with Filemaker allows remote users to modify sensitive purchase information via hidden form fields.

   Published 2000-02-08

   High·CVSS 7.5 EPSS 2.1%

   The shopping cart application provided with Filemaker allows remote users to modify sensitive purchase information via hidden form fields.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.