CVE-2015-6914: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx...

CVE-2015-4530

EMC Documentum CSRF vulnerability CVE-2015-4530 affects WebTop and related components (WebTop, WebTop-based clients; Administrator up to 7.2; DAM 6.5SP6; Web Publishers 6.5SP7; Task Space 6.7SP2). Root cause: incomplete fix for CVE-2014-2518. Impact: attackers can hijack user sessions, performing...

CVE-2015-4530: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in EMC Documentum WebTop before 6.8P01, Documentum Administrator through 7.2, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to hijack the...

Directory traversal

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. dot dot in the dir parameter to admin/asset/add-asset-compatibility...

CVE-2015-4425

Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. dot dot in the dir parameter to admin/asset/add-asset-compatibility...

PT-2015-6586

Name of the Vulnerable Software and Affected Versions pimcore versions prior to build 3473 Description The issue allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. dot dot in the dir parameter to "admin/asset/add-asset-compatibility"...

CVE-2015-4529

Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary w...

PT-2015-1698

Name of the Vulnerable Software and Affected Versions EMC Documentum WebTop versions prior to 6.8P02 EMC Documentum Administrator versions prior to 7.2P01 EMC Documentum Digital Assets Manager versions prior to 6.5SP6 EMC Documentum Web Publishers versions prior to 6.5SP7 EMC Documentum Task Spac...

CVE-2015-4529: Undefined Security Weakness

Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary w...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before...

Unrestricted file upload

Unrestricted file upload vulnerability in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25;...

CVE-2015-0551

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before...

CVE-2015-0551

EMC Documentum WebTop and client products contain multiple cross-site scripting (XSS) vulnerabilities (CVE-2015-0551) allowing remote authenticated users to inject arbitrary HTML/script via unspecified vectors. Affected products include WebTop 6.7SP1/6.7SP2/6.8 and client components: Documentum A...

PT-2015-2725

Name of the Vulnerable Software and Affected Versions EMC Documentum WebTop versions 6.7SP1 through 6.7SP1 P30, 6.7SP2 through 6.7SP2 P22, and 6.8 through 6.8 P00 EMC Documentum Administrator versions 6.7SP1 through 6.7SP1 P30, 6.7SP2 through 6.7SP2 P22, 7.0 through 7.0 P17, 7.1 through 7.1 P14,...

CVE-2015-0551: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before...

Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) - Cross-Site Request Forgery

Vulnerability type: Cross-site Request Forgery Vendor: http://www.ektron.com/ Product: Ektron Content Management System Affected version: = TIMELINE – 07/04/2015: Vulnerability found – 07/04/2015: Vendor informed – 08/04/2015: Vendor responded and acknowledged - 01/05/2015: MITRE issued CVE...

Ektron CMS 9.10 SP1 - CSRF Vulnerability

Vulnerability type: Cross-site Request Forgery Vendor: http://www.ektron.com/ Product: Ektron Content Management System Affected version: = 9.10 SP1 Build 9.1.0.184.1.114 Patched version: 9.10 SP1 Build 9.1.0.184.1.120 CVE ID: CVE-2015-3624 Credit: Jerold Hoong PROOF OF CONCEPT CSRF Cross-site...

Moxa Industrial Managed Switch Vulnerabilities

OVERVIEW Erwin Paternotte of Applied RiskApplied Risk Security Advisory AR2015001, Multiple Vulnerabilities in Moxa industrial manages switches, http://applied-risk.com/application/files/3414/4060/7148/AdvisoryMoxaMultipleVulnerabilities.pdf, web site last accessed September 3, 2015. has identifi...

The offline cookbook

Update: Together with Udacity I created a free offline-first interactive course. It involves taking an online-only site to full offline-first glory. Many of the patterns in this article are used. When AppCache arrived on the scene it gave us a couple of patterns to make content work offline. If...

Thomson Reuters Fixed Assets CS <=13.1.4 - Privileges Escalation Exploit

Exploit for windows platform in category local exploits Exploit Title: Thomson Reuters Fixed Assets CS Windows 7, Windows 8 CVE : 2014-9141 Product Affected: Fixed Assets CS =13.1.4 Workstation Install Note: 2003/2008 Terminal Services/Published apps may be vulnerable, depending on system...