Security vulnerabilities in Alfresco Content Services 7.0

[tmljack]

I'm attempting to privately communicate a number of security vulnerabilities I have found in the current version of Alfresco Content Services, I haven't checked the community edition but the vulnerabilities are likely to be present there too.

Is there a secure way to submit these? I've already attempted to contact security@alfresco.com but have received no reply.

[abhinavmishra14]

May be @EddieMay will be able to redirect to correct channel to pass on the concerns.

[EddieMay · Accepted solution]

Hi @tmljack 

I've reached out to you directly - we should be able to connect you with appropriate people internally.

Thanks,

[tmljack]

Thank you for the prompt response, I did not receive any direct communication on my end at this stage that I can see.

Feel free to send me an email however and am looking forward to being able to share the information in a secure manner.

[EddieMay]

Hi @tmljack 

I did email you last week but I think it got bounced back. Have emailed again just now.

Thanks again,

[swatcat91]

Hi Eddie,

I have been trying to get in touch with your team to report a new issue in Alfresco 7.x. I have mailed to appsecurity@hyland.com multiple times but I am unable to get a reply.

https://hub.alfresco.com/t5/alfresco-content-services-forum/vulnerability-in-alfresco-enteprise/m-p/... 

Can you direct me to the correct contact to report a security vulnerability ?