CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

UBUNTU-CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

CVE-2020-13239

Dolibarr 11.0.4 DMS/ECM module vulnerability: rendering of user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link enables stored XSS. Root cause is insufficient validation/handling of HTML attachments in Dolibarr’s DMS/ECM component. Report...

CVE-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

CVE-2020-13240

Dolibarr 11.0.4's DMS/ECM module is vulnerable: users with the 'Setup documents directories' permission can rename uploaded files to have insecure file extensions, bypassing the .noexe protection mechanism against XSS. This is a stored cross‑site scripting risk described across multiple sources (...

CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

CVE-2020-13240: Incorrect Default Permissions

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

PT-2020-13389 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 11.0.4 Description: The issue concerns the DMS/ECM module, which renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link, leading to a Cross-Site Scripting XSS...

CVE-2020-13239: Improper Neutralization of Input During Web Page Generation

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

Rockwell Automation E300 Overload Relay 193-ECM-ETR Motor Overload

Binary data 752367.prm...

Security Bulletin: FileNet CMIS (FNCMIS) leveraging Spring Framework is vulnerable to a denial of service caused by improper handling of range request by the ResourceHttpRequestHandler

Summary FileNet Content Management Interoperability Services CMIS, which ships with IBM Content Navigator, is affected by the following vulnerability: Spring Framework’s improper handling of ResourceHttpRequestHandler could result in denial of service condition. Vulnerability Details CVE-ID:...

Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in IBM® SDK Java™ Technology Edition

Summary Enterprise Content Management System Monitor has addressed the following vulnerability in IBM® SDK Java™ Technology Edition. This issue was disclosed as part of the IBM® SDK Java™ Technology Edition Quarterly CPU - Oct 2018 - Includes Oracle Oct 2018 CPU. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Enterprise Content Management System Monitor

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 and 8 used by Enterprise Content Management System Monitor. Enterprise Content Management System Monitor has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2018-1656 DESCRIPTION:The IBM Java...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Enterprise Content Management System Monitor

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version Java 6 and Java 7 used by Enterprise Content Management System Monitor. These issues were disclosed as part of the IBM Java SDK updates in October 2016. Vulnerability Details CVEID: CVE-2016-5573 DESCRIPTION:...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Enterprise Content Management System Monitor (CVE-2016-6304, CVE-2016-2177)

Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM Enterprise Content Management System Monitor. IBM Enterprise Content Management System Monitor has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6304...

Security Bulletin: Vulnerability in IBM Java SDK affect IBM Enterprise Content Management System Monitor (CVE-2016-3485)

Summary Vulnerability in IBM® SDK Java™ Technology Edition, Version 6 & 7 that is used by IBM Enterprise Content Management. These issues were disclosed as part of the IBM Java SDK updates in July 2016. Vulnerability Details CVEID: CVE-2016-3485 DESCRIPTION: An unspecified vulnerability in Oracle...

Security Bulletin: Reflected Cross-Site Scripting Vulnerability in IBM Content Navigator (CVE-2014-0874)

Summary Reflected Cross-Site Scripting Vulnerability in IBM Content Navigator Vulnerability Details CVEID: CVE-2014-0874 DESCRIPTION: Arbitrary characters inserted into request parameters are not properly encoded. Not encoding user-supplied input may expose a web application to cross-site...

P4wnP1: A Open Source USB Attack Platform

PenTestIT RSS Feed As of now, hardware security projects seem to be attracting me more than software based projects. Evidently, I wrote a few posts covering them - List of Portable Hardware Devices for Penetration Testing, List of Raspberry Pi DIY Projects for Anonymity, etc. among other awesome...

CIMA DocuClass ECM - Multiple Vulnerabilities

CIMA DocuClass ECM - Multiple Vulnerabilities Exploit Title: CIMA DocuClass Enterprise Content Management - Multiple Vulnerabilities Date: July 15, 2016 Exploit Author: Karn Ganeshen ipositivesecurity.blogspot.com Vendor Homepage: cima-software.com Version: app version All Tested on: Microsoft...

CVE-2015-1904

IBM Business Process Manager BPM 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management ECM integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypas...