PT-2014-3726

Name of the Vulnerable Software and Affected Versions EMC Documentum TaskSpace TSP versions 6.7SP1 before P25 EMC Documentum TaskSpace TSP versions 6.7SP2 before P11 Description The issue allows remote authenticated users to read arbitrary files by modifying the imaging-service URL. Recommendatio...

CVE-2014-0630: Undefined Security Weakness

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL...

CVE-2014-0629: Undefined Security Weakness

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dmworld group and the dmsuperusersdynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by...

PT-2014-3725

Name of the Vulnerable Software and Affected Versions EMC Documentum TaskSpace TSP versions 6.7SP1 before P25 EMC Documentum TaskSpace TSP versions 6.7SP2 before P11 Description The issue arises from the incorrect handling of the interaction between the dm world group and the dm superusers dynami...

EMC Documentum Foundation Services unauthorized access

Filesystem access is possible...

ESA-2014-005: EMC Documentum Foundation Services (DFS) Content Access Vulnerability

ESA-2014-005.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-005: EMC Documentum Foundation Services DFS Content Access Vulnerability EMC Identifier: ESA-2014-005 CVE Identifier: CVE-2014-0622 Severity Rating: CVSS v2 Base Score: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C Affected products: • EMC DF...

CVE-2014-0622

The web service in EMC Documentum Foundation Services DFS 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecifie...

Design/Logic Flaw

The web service in EMC Documentum Foundation Services DFS 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecifie...

CVE-2014-0622

The web service in EMC Documentum Foundation Services DFS 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecifie...

PT-2014-3718

Name of the Vulnerable Software and Affected Versions EMC Documentum Foundation Services DFS versions 6.5 through 6.7 before 6.7 SP1 P22 EMC Documentum Foundation Services DFS version 6.7 SP2 before P08 EMC Documentum Foundation Services DFS version 7.0 before P12 EMC Documentum Foundation Servic...

CVE-2014-0622: Undefined Security Weakness

The web service in EMC Documentum Foundation Services DFS 6.5 through 6.7 before 6.7 SP1 P22, 6.7 SP2 before P08, 7.0 before P12, and 7.1 before P01 does not properly implement content uploading, which allows remote authenticated users to bypass intended content access restrictions via unspecifie...

CVE-2013-6173

Multiple cross-site request forgery CSRF vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to...

Sql injection

Multiple SQL injection vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote authenticated users to execute...

CVE-2013-6177

CVE-2013-6177 affects EMC Document Sciences xPression in versions 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05 (Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine). Description: a Path Traversal vulnerability in xDashboard allows...

CVE-2013-6174

EMC Document Sciences xPression contains an open redirect vulnerability (CVE-2013-6174) in the xAdmin application (and related xDashboard context) that could be exploited to redirect users to arbitrary sites for phishing. Affected versions are 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5...

CVE-2013-6175

Multiple cross-site scripting XSS vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to inject...

CVE-2013-6173

EMC Document Sciences xPression is affected by CSRF vulnerabilities (CVE-2013-6173) in xAdmin/xDashboard. Affected product lines: Enterprise Edition Publish Engine and Compuset Engine, and Documentum Edition. Versions: 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05. Impact:...

PT-2013-5962

Name of the Vulnerable Software and Affected Versions EMC Document Sciences xPression versions 4.1 before Patch 47 EMC Document Sciences xPression versions 4.2 before Patch 26 EMC Document Sciences xPression versions 4.5 before Patch 05 Description A directory traversal issue allows remote...

CVE-2013-6176: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote authenticated users to execute...

CVE-2013-6174: Improper Input Validation

Multiple open redirect vulnerabilities in xAdmin in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to redirect...