CVE-2015-0517

The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file...

CVE-2015-0518

EMC Documentum D2 (D2FS web service Properties component) is affected by CVE-2015-0518. A flaw in the D2FS Properties service allows a remote authenticated, low-privilege D2 user to modify group permissions and escalate to superuser privileges. Affected products/versions include D2 3.1 through SP...

EMC Documentum D2 < 4.1 P22 / 4.2 P11 Multiple Vulnerabilities (ESA-2015-010)

The remote host is running a version EMC Documentum D2 prior to 4.1 P22 / 4.2 P11. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to the D2-API component logging the MD5 hash of the passphrase used to encrypt sensitive information and...

EMC Documentum D2 Remote Privilege Elevation Vulnerability

EMC Documentum D2 is an enterprise document management software. A security vulnerability exists in a method in the Properties service of the EMC Documentum D2 WEB services component that allows a low-privileged D2 user to manipulate group privileges and elevate privileges. A remote attacker coul...

EMC Documentum D2 Information Disclosure Vulnerability

EMC Documentum D2 is an enterprise document management software. The EMC Documentum D2-API formation logs passwords and user credentials that are used to encrypt D2 sensitive systems using MD5 hashes recorded to log files, where low-privileged users can obtain the MD5 hashes and perform malicious...

ESA-2014-067: EMC Documentum D2 Privilege Escalation Vulnerability

ESA-2014-067.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-067: EMC Documentum D2 Privilege Escalation Vulnerability EMC Identifier: ESA-2014-067 CVE Identifier: CVE-2014-2515 Severity: CVSSv2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: • EMC Documentum D2 3.1 and...

EMC Documentum D2 Detection (credentialed)

Binary data emcdocumentumd2detect.nbin...

EMC Documentum D2 Privilege Escalation (ESA-2014-067)

The remote host is running EMC Documentum D2. It is, therefore, affected by a privilege escalation vulnerability due to a flaw in the 'D2GetAdminTicketMethod' and 'D2RefreshCacheMethod' methods. A remote, authenticated attacker can exploit these methods to obtain superuser privileges. C Tenable...

CVE-2014-2515

EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket...

Design/Logic Flaw

EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket...

CVE-2014-2515

CVE-2014-2515 affects EMC Documentum D2 and its related components. The issue arises from inadequate access control in the D2GetAdminTicketMethod and D2RefreshCacheMethod, allowing a remote, authenticated user to obtain a superuser ticket and escalate privileges. Affected product versions include...

CVE-2014-2515

EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket...

EMC Documentum D2 Privilege Escalation (ESA-2014-045)

The remote host is running EMC Documentum D2. It is, therefore, affected by a privilege escalation vulnerability due to a flaw in the Documentum Query Language DQL engine. A remote, authenticated attacker can exploit this vulnerability to execute arbitrary DQL queries with superuser privileges. C...

EMC Documentum D2 privilege escalation

It's possible to execute DQL Query with super-user privileges...

ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability

ESA-2014-045.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability EMC Identifier: ESA-2014-045 CVE Identifier: CVE-2014-2504 Severity: CVSSv2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: • EMC Documentum D2...

CVE-2014-2504

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

CVE-2014-2504

EMC Documentum D2 is affected by CVE-2014-2504 across multiple releases (3.1 before P20, 3.1SP1 before P02, 4.0 before P10, 4.1 before P13, 4.2 before P01). The issue stems from a flaw in the Documentum Query Language (DQL) engine that enables an authenticated remote user to bypass access restric...

CVE-2006-1153

SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board IPB...

Sql injection

SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board IPB...

CVE-2006-1153

CVE-2006-1153 describes a SQL injection vulnerability in D2-Shoutbox 4.2 that allows remote attackers to execute arbitrary SQL commands via the load parameter when performing a Shoutbox action through Invision Power Board (IPB). The issue affects D2-Shoutbox 4.2 as documented in NVD/NVD-derived r...