PT-2014-4740

Name of the Vulnerable Software and Affected Versions EMC RSA Adaptive Authentication Hosted version 11.0 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML. Recommendations For version 11.0, update to ...

EMC Documentum D2 privilege escalation

It's possible to execute DQL Query with super-user privileges...

EMC RSA Archer crossite scripting

Multiple crossite scripting conditions...

ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability

ESA-2014-045.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability EMC Identifier: ESA-2014-045 CVE Identifier: CVE-2014-2504 Severity: CVSSv2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: • EMC Documentum D2...

CVE-2014-2504

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

Design/Logic Flaw

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

CVE-2014-0639

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer 5.x before GRC 5.4 SP1 P3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer 5.x before GRC 5.4 SP1 P3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0639

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer 5.x before GRC 5.4 SP1 P3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-0639

CVE-2014-0639 affects RSA Archer GRC 5.x, with fixes only in RSA Archer GRC 5.4 SP1 P3. The ESA-2014-021 advisory confirms multiple cross-site scripting vulnerabilities in RSA Archer GRC 5.4 SP1 P3 platform, allowing an attacker to execute arbitrary HTML/JavaScript in a user’s browser session wit...

CVE-2014-0639: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EMC RSA Archer 5.x before GRC 5.4 SP1 P3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-3734

Name of the Vulnerable Software and Affected Versions EMC RSA Archer versions 5.x before 5.4 SP1 P3 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The estimated number of...

CVE-2014-2504

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

CVE-2014-2504

EMC Documentum D2 is affected by CVE-2014-2504 across multiple releases (3.1 before P20, 3.1SP1 before P02, 4.0 before P10, 4.1 before P13, 4.2 before P01). The issue stems from a flaw in the Documentum Query Language (DQL) engine that enables an authenticated remote user to bypass access restric...

CVE-2014-2504: Undefined Security Weakness

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

PT-2014-4742

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 before P20 EMC Documentum D2 version 3.1 SP1 before P02 EMC Documentum D2 version 4.0 before P10 EMC Documentum D2 version 4.1 before P13 EMC Documentum D2 version 4.2 before P01 Description The issue allows remo...

CVE-2014-0643

EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name...

Authentication flaw

EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name...

CVE-2014-0643

EMC RSA NetWitness before 9.8.5.19 and RSA Security Analytics before 10.2.4 and 10.3.x before 10.3.2, when Kerberos PAM is enabled, do not require a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid account name...

CVE-2014-0643

CVE-2014-0643 affects EMC RSA NetWitness (before 9.8.5.19) and RSA Security Analytics (before 10.2.4 and before 10.3.2) where Kerberos PAM is enabled. The vulnerability allows remote attackers to bypass authentication by using a valid account name without a password, due to an authentication bypa...