OpenText Documentum Content Server SQL Injection

!/usr/bin/env python import socket import sys from os.path import basename from dctmpy.docbaseclient import DocbaseClient from dctmpy.obj.typedobject import TypedObject CIPHERS = "ALL:aNULL:!eNULL" def usage: print "usage:\n\t%s host port user password" % basenamesys.argv0 def main: if lensys.arg...

OpenText Documentum Content Server - dm_bp_transition.ebs docbase Method Arbitrary Code Execution

OpenText Documentum Content Server - dmbptransition.ebs docbase Method Arbitrary Code Execution ''' CVE Identifier: CVE-2017-7221 Vendor: OpenText Affected products: OpenText Documentum Content Server all versions Researcher: Andrey B. Panfilov Severity Rating: CVSS v3 Base Score: 8.8...

Design/Logic Flaw

OpenText Documentum Content Server allows superuser access via sysobjsave or save of a crafted object, followed by an unauthorized "UPDATE dmdbo.dmusers SET userprivileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-453...

OpenText Documentum Content Server Privilege Escalation Exploit

OpenText Documentum Content Server suffers from a privilege evaluation issue using crafted RPC save commands. Two proof of concepts included CVE-2017-7220-01.py: !/usr/bin/env python import socket import sys from os.path import basename from dctmpy.docbaseclient import DocbaseClient from...

EMC Documentum Content Server DQL Injection Vulnerability

EMC Documentum Content Server is a content management service system from EMC. A DQL injection vulnerability exists in EMC Documentum Content Server because the program fails to properly filter user-submitted input. A remote attacker can exploit the vulnerability by sending a specially crafted...

CVE-2017-5585

OpenText Documentum Content Server formerly EMC Documentum Content Server 7.3, when PostgreSQL Database is used and returntopresultsrowbased config option is false, does not properly restrict DQL hints, which allows remote authenticated users to conduct DQL injection attacks and execute arbitrary...

OpenText Documentum Content Server 7.3 SQL Injection

CVE Identifier: CVE-2017-5585 Vendor: OpenText Affected products: OpenText Documentum Content Server 7.3 PostgreSQL builds only Researcher: Andrey B. Panfilov Severity Rating: CVSS v3 Base Score: 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Fix: not available Description: Previously announced fix for...

ESA-2015-144: EMC Documentum Content Server Privilege Escalation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-144: EMC Documentum Content Server Privilege Escalation Vulnerability EMC Identifier: ESA-2015-144 CVE Identifier: CVE-2015-4544 Severity Rating: CVSS v2 Base Score: 8.2 AV:N/AC:M/Au:S/C:C/I:C/A:P Affected products: • EMC Documentum Content...

EMC Documentum Content Server Privilege Gain Vulnerability

EMC Documentum Content Server is a content management service system from EMC. The system is mainly used to manage Documentum content repository, can create, modify and track documents and other operations. A security vulnerability exists in EMC Documentum Content Server versions 7.1 and 7.2, whi...

CVE-2015-4544

EMC Documentum Content Server before 7.1P20 and 7.2.x before 7.2P04 does not properly verify authorization for dmjob object access, which allows remote authenticated users to obtain superuser privileges via crafted object operations. NOTE: this vulnerability exists because of an incomplete fix fo...

ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities EMC Identifier: ESA-2015-131 CVE Identifier: CVE-2015-4531, CVE-2015-4532, CVE-2015-4533, CVE-2015-4534, CVE-2015-4535, CVE-2015-4536 Severity Rating: CVSS v2 Base Score: See below f...

EMC Documentum Content Server: arbitrary code execution (incomplete fix in CVE-2015-4532)

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed For detailed description see http://seclists.org/bugtraq/2015/Jul/51 New behavior introduced in CVE-2015-4532: API ?,c,execute domethod WITH METHOD='dmbptransition', ARGUMENTS=' repo repo...

sysadmin privilege in EMC Documentum Content Server

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed In 2011 Yuri Simone discovered a security flaw in EMC Documentum Content Server, which allows users with sysadmin privileges to elevate their privileges to superuser see CVE-2011-4144. On...

CVE-2015-4533

EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom scrip...

Design/Logic Flaw

Java Method Server JMS in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 allows remote authenticated users to execute arbitrary code by forging a signature for a query string that lacks the methodverb parameter...

CVE-2015-4535

Java Method Server JMS in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02, when debugtrace is configured, allows remote authenticated users to gain super-user privileges by leveraging the ability to read a log file containing ...

CVE-2015-4534

EMC Documentum Content Server’s Java Method Server (JMS) contains a vulnerability (CVE-2015-4534) where JMS fails to validate signatures for query strings missing the method_verb parameter, allowing remote authenticated users to forge signatures and execute arbitrary code in the JMS context. Affe...

CVE-2015-4536

Summary (CVE-2015-4536) EMC Documentum Content Server versions affected are 7.0 prior to P20, 7.1 prior to P18, and 7.2 prior to P02. When RPC tracing is enabled, obfuscated passwords of users with inline authentication are written to the log file in clear text, enabling a remote authenticated at...

EMC Documentum Content Server Remote Privilege Vulnerability

EMC Documentum Content Server is a content management service system from EMC. The system is mainly used to manage Documentum content repository, can create, modify and track documents and other operations. A remote elevation vulnerability exists in EMC Documentum Content Server. A remote attacke...

EMC Documentum Content Server Remote Code Execution Vulnerability (CNVD-2015-05461)

EMC Documentum Content Server is a content management service system from EMC. The system is mainly used to manage Documentum content repository, can create, modify and track documents and other operations. A remote code execution vulnerability exists in EMC Documentum Content Server. An attacker...