CVE-2016-0882

EMC Documentum xCP is affected: versions 2.1 before patch 23 and 2.2 before patch 11 are vulnerable to a XML External Entity (XXE) issue. The vulnerability enables remote authenticated users to read arbitrary files by sending a POST request containing an XML external entity declaration combined w...

CVE-2016-0881

EMC Documentum xCP is affected: versions 2.1 before patch 23 and 2.2 before patch 11 expose a DQL injection via REST requests, allowing remote authenticated attackers to obtain sensitive repository information. The root cause is improper handling of XCP REST requests, enabling execution of SQL-li...

CVE-2016-0882: Undefined Security Weakness

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

PT-2016-4441

Name of the Vulnerable Software and Affected Versions EMC Documentum xCP versions 2.1 through 2.1 before patch 23 EMC Documentum xCP versions 2.2 through 2.2 before patch 11 Description The issue allows remote authenticated users to read arbitrary files via a POST request containing an XML extern...

PT-2016-4440

Name of the Vulnerable Software and Affected Versions EMC Documentum xCP versions 2.1 before patch 23 EMC Documentum xCP versions 2.2 before patch 11 Description The issue allows remote authenticated users to conduct Documentum Query Language DQL injection attacks. This is achieved by appending a...

CVE-2016-0881: Improper Neutralization of Special Elements in Output Used by a Downstream Component

EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and obtain sensitive repository information by appending a query to a REST request...

CVE-2015-6852

Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted parameter...

Default credentials

EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session...

Directory traversal

Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted parameter...

CVE-2015-6850

EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session...

CVE-2015-6852

CVE-2015-6852 affects EMC Secure Remote Services Virtual Edition 3.x prior to 3.10. The API is vulnerable to a directory traversal issue that allows remote authenticated users to read log files via a crafted parameter. The vulnerability is described in multiple sources (NVD/CNVD) with a CVSS v3 b...

CVE-2015-6850

EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session...

CVE-2015-6850

EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 have a default root password that allows local users to gain privileges by leveraging an active login session. Affected component: root account on GeoSynchrony; root cause: default credential exposed on install; impact: local privile...

CVE-2015-6852

Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted parameter...

PT-2015-7392

Name of the Vulnerable Software and Affected Versions EMC Secure Remote Services Virtual Edition versions 3.x before 3.10 Description The issue allows remote authenticated users to read log files via a crafted parameter due to a directory traversal vulnerability in the API. Recommendations For...

CVE-2015-6852: Exposure of Sensitive Information to an Unauthorized Actor

Directory traversal vulnerability in the API in EMC Secure Remote Services Virtual Edition 3.x before 3.10 allows remote authenticated users to read log files via a crafted parameter...

CVE-2015-6850: Undefined Security Weakness

EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session...

PT-2015-7390

Name of the Vulnerable Software and Affected Versions EMC VPLEX GeoSynchrony versions 5.4 SP1 before P3 EMC VPLEX GeoSynchrony versions 5.5 before Patch 1 Description The issue concerns a default password for the root account, allowing local users to gain privileges by leveraging a login session...

EMC VPLEX GeoSynchrony Local Mobilization Vulnerability

EMC VPLEX is a set of next-generation data storage platforms for moving and accessing information within, across, and between data centers from EMC; GeoSynchrony is a VPLEX operating system. A local lift vulnerability exists in EMC VPLEX GeoSynchrony. A local attacker could exploit this...

CVE-2015-6851

EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM Inspector...