CVE-2017-14960

CVE-2017-14960 affects EMC OpenText/Document Sciences xPression xDashboard. The vulnerability is a SQL Injection in xDashboard (v4.5SP1 Patch 13) via the parameter model.jobHistoryId used in jobDocHistoryList.action, enabling an attacker to retrieve data from the underlying database. The issue is...

PT-2018-5749

Name of the Vulnerable Software and Affected Versions: OpenText Document Sciences xPression version 4.5SP1 Patch 13 Description: The issue is related to SQL Injection in xDashboard. Recommendations: For version 4.5SP1 Patch 13, at the moment, there is no information about a newer version that...

CVE-2017-14755: Improper Neutralization of Input During Web Page Generation

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to Cross-Site Scripting: /xAdmin/html/XPressoDoc, parameter: categoryId...

CVE-2017-14754: Improper Limitation of a Pathname to a Restricted Directory

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to Arbitrary File Read: /xAdmin/html/cmdatasourcegroupxsd.jsp, parameter: xsddatasourceschemafile filename. In order for this vulnerability to be...

CVE-2017-14757: Improper Neutralization of Special Elements used in an SQL Command

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to SQL Injection: /xDashboard/html/jobhistory/downloadSupportFile.action, parameter: jobRunId. In order for this vulnerability to be exploited, an...

CVE-2017-14756: Improper Neutralization of Input During Web Page Generation

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to Cross-Site Scripting: /xAdmin/html/Deployment catid...

CVE-2017-14758: Improper Neutralization of Special Elements used in an SQL Command

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to SQL Injection: /xAdmin/html/cmdoclistviewuc.jsp, parameter: documentId. In order for this vulnerability to be exploited, an attacker must authenticat...

CVE-2017-14759: Improper Restriction of XML External Entity Reference

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory...

CVE-2017-14759

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory...

PT-2017-13673

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue allows for SQL Injection, specifically through the /xAdmin/html/cm doclist view uc.jsp API endpoint, with the vulnerable parameter being documentId. ...

OpenText Document Sciences xPression 4.5SP1 Patch 13 - documentId SQL Injection

OpenText Document Sciences xPression 4.5SP1 Patch 13 - documentId SQL Injection Title: OpenText Document Sciences xPression formerly EMC Document Sciences xPression - SQL Injection Author: Marcin Woloszyn Date: 27. September 2017 CVE: CVE-2017-14758 Affected Software: ================== OpenText...

OpenText Document Sciences xPression 4.5SP1 Patch 13 - jobRunId SQL Injection Vulnerability

Exploit for jsp platform in category web applications Title: OpenText Document Sciences xPression formerly EMC Document Sciences xPression - SQL Injection Author: Marcin Woloszyn Date: 27. September 2017 CVE: CVE-2017-14758 Affected Software: ================== OpenText Document Sciences xPressio...

PT-2017-13670

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue is related to Cross-Site Scripting. The "/xAdmin/html/XPressoDoc" API endpoint is vulnerable, specifically the categoryId parameter. Recommendations...

PT-2017-13671

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue is related to Cross-Site Scripting. The /xAdmin/html/Deployment API endpoint is affected, specifically the cat id variable. Recommendations For...

PT-2017-13669

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue allows for Arbitrary File Read. An attacker must first authenticate to the application. The "/xAdmin/html/cm datasource group xsd.jsp" API endpoint i...

PT-2017-13672

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue allows for SQL Injection, specifically through the "/xDashboard/html/jobhistory/downloadSupportFile.action" API endpoint, with the jobRunId parameter...

OpenText Document Sciences xPression 4.5SP1 Patch 13 - documentId SQL Injection Vulnerability

Exploit for jsp platform in category web applications Title: OpenText Document Sciences xPression formerly EMC Document Sciences xPression - SQL Injection Author: Marcin Woloszyn Date: 27. September 2017 CVE: CVE-2017-14757 Affected Software: ================== OpenText Document Sciences xPressio...

OpenText Document Sciences xPression 4.5SP1 Patch 13 - 'jobRunId' SQL Injection

Title: OpenText Document Sciences xPression formerly EMC Document Sciences xPression - SQL Injection Author: Marcin Woloszyn Date: 27. September 2017 CVE: CVE-2017-14757 Affected Software: ================== OpenText Document Sciences xPression formerly EMC Document Sciences xPression Exploit was...

OpenText Document Sciences xPression 4.5SP1 Patch 13 Arbitrary File Read Vulnerability

Exploit for java platform in category web applications Title: OpenText Document Sciences xPression formerly EMC Document Sciences xPression - Arbitrary File Read Author: Marcin Woloszyn Date: 27. September 2017 CVE: CVE-2017-14754 Affected Software: ================== OpenText Document Sciences...

OpenText Document Sciences xPression 4.5SP1 Patch 13 SQL Injection Vulnerability

Exploit for java platform in category web applications Title: OpenText Document Sciences xPression formerly EMC Document Sciences xPression - SQL Injection Author: Marcin Woloszyn Date: 27. September 2017 CVE: CVE-2017-14758 Affected Software: ================== OpenText Document Sciences xPressi...