CVE-2017-5585

OpenText Documentum Content Server 7.3 (PostgreSQL builds) with return_top_results_row_based=false is vulnerable to DQL injection due to incomplete restriction of DQL hints. Remote authenticated users can craft requests to execute arbitrary DML or DDL commands. Root cause is an incomplete fix for...

PT-2017-16592

Name of the Vulnerable Software and Affected Versions OpenText Documentum Content Server versions 7.3 Description The issue allows remote authenticated users to conduct DQL injection attacks and execute arbitrary DML or DDL commands via a crafted request, due to the improper restriction of DQL...

CVE-2017-5585: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OpenText Documentum Content Server formerly EMC Documentum Content Server 7.3, when PostgreSQL Database is used and returntopresultsrowbased config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary...

OpenText Documentum Content Server 7.3 SQL Injection

CVE Identifier: CVE-2017-5585 Vendor: OpenText Affected products: OpenText Documentum Content Server 7.3 PostgreSQL builds only Researcher: Andrey B. Panfilov Severity Rating: CVSS v3 Base Score: 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Fix: not available Description: Previously announced fix for...

EMC Documentum D2 DQL Injection Vulnerability

EMC Documentum D2 is an enterprise-class content management system from EMC. The system manages the entire information lifecycle through creation, modification, tracking and other functions, and it includes a number of extensions, such as Documentum Web Publisher Web Content Management, Documentu...

CVE-2016-9873

EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information,...

Design/Logic Flaw

EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information,...

CVE-2016-9873

EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information,...

CVE-2016-9873

CVE-2016-9873 concerns EMC Documentum D2 4.5 and 4.6, where a DQL (Document Query Language) injection allows an authenticated, low-privilege attacker to execute arbitrary DQL commands, potentially exposing/modifying data or disrupting services. The vulnerability is documented across multiple sour...

CVE-2016-9873

EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information,...

CVE-2016-9873: Improper Neutralization of Special Elements used in a Command

EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information,...

PT-2017-10372

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 4.5 through 4.6 Description The issue allows an authenticated low-privileged attacker to potentially exploit it and access information, modify data, or disrupt services by causing execution of arbitrary DQL commands ...

EMC Documentum D2 4.5.x and 4.6.x < 4.7 Multiple Vulnerabilities (ESA-2016-167)

The remote host is running a version of EMC Documentum D2 that is 4.5.x or 4.6.x prior to 4.7. It is, therefore, affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can...

[SECURITY] Fedora 24 Update: php-doctrine-orm-2.4.8-1.fc24

Object relational mapper ORM for PHP that sits on top of a powerful datab ase abstraction layer DBAL. One of its' key features is the option to write database queries in a proprietary object oriented SQL dialect called Doctri ne Query Language DQL, inspired by Hibernate's HQL. This provides...

[SECURITY] Fedora 23 Update: php-doctrine-orm-2.4.8-1.fc23

Object relational mapper ORM for PHP that sits on top of a powerful datab ase abstraction layer DBAL. One of its' key features is the option to write database queries in a proprietary object oriented SQL dialect called Doctri ne Query Language DQL, inspired by Hibernate's HQL. This provides...

Design/Logic Flaw

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and obtain sensitive repository information by appending a query to a REST request...

CVE-2016-0881

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and obtain sensitive repository information by appending a query to a REST request...

CVE-2016-0881

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and obtain sensitive repository information by appending a query to a REST request...

CVE-2016-0881

EMC Documentum xCP is affected: versions 2.1 before patch 23 and 2.2 before patch 11 expose a DQL injection via REST requests, allowing remote authenticated attackers to obtain sensitive repository information. The root cause is improper handling of XCP REST requests, enabling execution of SQL-li...

CVE-2016-0881: Improper Neutralization of Special Elements in Output Used by a Downstream Component

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and obtain sensitive repository information by appending a query to a REST request...