PT-2014-4746

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 6.7 SP1 P28 EMC Documentum Content Server versions 6.7 SP2 prior to P14 EMC Documentum Content Server versions 7.0 prior to P15 EMC Documentum Content Server versions 7.1 prior to P05 Description...

PT-2014-4744

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 6.7 SP1 P28 EMC Documentum Content Server versions 6.7 SP2 prior to P14 EMC Documentum Content Server versions 7.0 prior to P15 EMC Documentum Content Server versions 7.1 prior to P05 Description...

CVE-2014-2507: Improper Neutralization of Special Elements used in an OS Command

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...

CVE-2014-2508: Improper Input Validation

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on database actions via vectors involving DQL hints...

CVE-2014-2506: Undefined Security Weakness

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors...

PT-2014-4745

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 6.7 SP1 P28 EMC Documentum Content Server versions 6.7 SP2 prior to P14 EMC Documentum Content Server versions 7.0 prior to P15 EMC Documentum Content Server versions 7.1 prior to P05 Description...

CVE-2014-2503

The thumbnail proxy server in EMC Documentum Digital Asset Manager DAM 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query strin...

Design/Logic Flaw

The thumbnail proxy server in EMC Documentum Digital Asset Manager DAM 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query strin...

PT-2014-4741

Name of the Vulnerable Software and Affected Versions EMC Documentum Digital Asset Manager DAM versions 6.5 SP3 through 6.5 SP6 before P13 Description The issue allows remote attackers to conduct Documentum Query Language DQL injection attacks, bypassing intended restrictions on querying objects...

CVE-2014-2503: Improper Input Validation

The thumbnail proxy server in EMC Documentum Digital Asset Manager DAM 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query strin...

CVE-2014-2503

The thumbnail proxy server in EMC Documentum Digital Asset Manager DAM 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query strin...

EMC Documentum D2 Privilege Escalation (ESA-2014-045)

The remote host is running EMC Documentum D2. It is, therefore, affected by a privilege escalation vulnerability due to a flaw in the Documentum Query Language DQL engine. A remote, authenticated attacker can exploit this vulnerability to execute arbitrary DQL queries with superuser privileges. C...

EMC Documentum D2 privilege escalation

It's possible to execute DQL Query with super-user privileges...

ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability

ESA-2014-045.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability EMC Identifier: ESA-2014-045 CVE Identifier: CVE-2014-2504 Severity: CVSSv2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: • EMC Documentum D2...

CVE-2014-2504

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

Design/Logic Flaw

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

CVE-2014-2504

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

CVE-2014-2504

EMC Documentum D2 is affected by CVE-2014-2504 across multiple releases (3.1 before P20, 3.1SP1 before P02, 4.0 before P10, 4.1 before P13, 4.2 before P01). The issue stems from a flaw in the Documentum Query Language (DQL) engine that enables an authenticated remote user to bypass access restric...

CVE-2014-2504: Undefined Security Weakness

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

PT-2014-4742

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 before P20 EMC Documentum D2 version 3.1 SP1 before P02 EMC Documentum D2 version 4.0 before P10 EMC Documentum D2 version 4.1 before P13 EMC Documentum D2 version 4.2 before P01 Description The issue allows remo...