EMC Documentum TaskSpace远程权限提升漏洞

Bugtraq ID:65990 CVE ID:CVE-2014-0629 EMC Documentum是一款企业文档和图像管理工具，使文档的创建、修改、跟踪和在业务过程中的利用变得高效、规范和严谨。 把dmworld group用户提交到dmsuperusersdynamic组时存在安全漏洞，允许非特权TSP用户获取敏感特权信息。 0 EMC Documentum TaskSpace TSP 6.7SP1 EMC Documentum TaskSpace TSP 6.7SP2 厂商补丁： EMC ----- EMC Documentum TaskSpace 6.7 SP1 P25和6....

EMC Documentum TaskSpace信息泄漏漏洞

Bugtraq ID:65991 CVE ID:CVE-2014-0630 EMC Documentum是一款企业文档和图像管理工具，使文档的创建、修改、跟踪和在业务过程中的利用变得高效、规范和严谨。 EMC Documentum TaskSpace服务器不正确过滤用户提交的输入，允许远程攻击者利用漏洞修改图像服务URL，获取敏感内容。 0 EMC Documentum TaskSpace TSP 6.7SP1 EMC Documentum TaskSpace TSP 6.7SP2 厂商补丁： HostBill ----- HostBill...

CVE-2014-0624

EMC RSA Data Loss Prevention DLP 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors...

CVE-2014-0629

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dmworld group and the dmsuperusersdynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by...

CVE-2014-0630

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL...

Design/Logic Flaw

EMC RSA Data Loss Prevention DLP 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors...

Information disclosure

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dmworld group and the dmsuperusersdynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by...

Code injection

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL...

CVE-2014-0624

EMC RSA Data Loss Prevention DLP 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors...

CVE-2014-0629

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dmworld group and the dmsuperusersdynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by...

CVE-2014-0630

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL...

CVE-2014-0629

EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11 are affected by CVE-2014-0629 due to an incorrect group-addition implementation between the dm_world group and the dm_superusers_dynamic group. This can allow remote authenticated users to obtain sensitive information and gain...

CVE-2014-0630

CVE-2014-0630 affects EMC Documentum TaskSpace (TSP) 6.7SP1 before P25 and 6.7SP2 before P11. The issue allows remote authenticated users to retrieve arbitrary files by modifying the imaging-service URL used to stream content, indicating a failure in input/url validation within the imaging servic...

CVE-2014-0624

CVE-2014-0624 corresponds to an improper session management vulnerability in RSA Data Loss Prevention (DLP). The issue affects RSA DLP versions 9.0, 9.5, and 9.6 (Enterprise Manager) prior to 9.6-SP2, where session handling could allow a lower-privileged, authenticated user to access content and ...

CVE-2014-0629: Undefined Security Weakness

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 does not properly handle the interaction between the dmworld group and the dmsuperusersdynamic group, which allows remote authenticated users to obtain sensitive information and gain privileges in opportunistic circumstances by...

CVE-2014-0630: Undefined Security Weakness

EMC Documentum TaskSpace TSP 6.7SP1 before P25 and 6.7SP2 before P11 allows remote authenticated users to read arbitrary files via a modified imaging-service URL...

CVE-2014-0624: Undefined Security Weakness

EMC RSA Data Loss Prevention DLP 9.x before 9.6-SP2 does not properly manage sessions, which allows remote authenticated users to gain privileges and bypass intended content-reading restrictions via unspecified vectors...

PT-2014-3720

Name of the Vulnerable Software and Affected Versions EMC RSA Data Loss Prevention DLP versions 9.0 through 9.6-SP1 Description The issue is related to improper session management, allowing remote authenticated users to gain privileges and bypass content-reading restrictions. Recommendations For...

PT-2014-3725

Name of the Vulnerable Software and Affected Versions EMC Documentum TaskSpace TSP versions 6.7SP1 before P25 EMC Documentum TaskSpace TSP versions 6.7SP2 before P11 Description The issue arises from the incorrect handling of the interaction between the dm world group and the dm superusers dynami...

PT-2014-3726

Name of the Vulnerable Software and Affected Versions EMC Documentum TaskSpace TSP versions 6.7SP1 before P25 EMC Documentum TaskSpace TSP versions 6.7SP2 before P11 Description The issue allows remote authenticated users to read arbitrary files by modifying the imaging-service URL. Recommendatio...