PT-2015-6613

Name of the Vulnerable Software and Affected Versions EMC Documentum Content Server versions prior to 7.0 P20 EMC Documentum Content Server versions 7.1 prior to P18 EMC Documentum Content Server versions 7.2 prior to P02 Description The issue allows remote authenticated users to obtain sensitive...

CVE-2015-4535: Undefined Security Weakness

Java Method Server JMS in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02, when debugtrace is configured, allows remote authenticated users to gain super-user privileges by leveraging the ability to read a log file containing ...

CVE-2015-4531: Undefined Security Weakness

EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization for subgroups of privileged groups, which allows remote authenticated sysadmins to gain super-user privileges, and bypass intended...

CVE-2015-4536: Exposure of Sensitive Information to an Unauthorized Actor

EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allows remote authenticated users to obtain sensitive information by reading this file...

EMC Documentum Content Server Multiple Vulnerabilities (ESA-2015-131)

The version of EMC Documentum Content Server running on the remote host is affected by multiple vulnerabilities : - A privilege escalation vulnerability exists due to improper authorization checks performed on subgroups within the dmsuperusers group. An authenticated, remote attacker can exploit...

EMC Documentum Content Server Code Execution Vulnerability

EMC Documentum Content Server suffers from an arbitrary code execution vulnerability. Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed For detailed description see http://seclists.org/bugtraq/2015/Jul/51 New behavior introduced in...

EMC Documentum Content Server Privilege Escalation Vulnerability

EMC Documentum Content Server suffers from a privilege escalation vulnerability. Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed In 2011 Yuri Simone discovered a security flaw in EMC Documentum Content Server, which allows users with...

EMC Documentum Content Server Information Disclosure (ESA-2015-131)

The version of EMC Documentum Content Server running on the remote host is affected an information disclosure vulnerability due to passwords being stored as plaintext in log files for users with inline authentication. An authenticated, remote attacker with access to the log files can exploit this...

EMC Documentum Content Server Privilege Escalation

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed In 2011 Yuri Simone discovered a security flaw in EMC Documentum Content Server, which allows users with sysadmin privileges to elevate their privileges to superuser see CVE-2011-4144. On...

EMC Documentum Content Server Code Execution

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed For detailed description see http://seclists.org/bugtraq/2015/Jul/51 New behavior introduced in CVE-2015-4532: API ?,c,execute domethod WITH METHOD='dmbptransition', ARGUMENTS=' repo repo...

EMC Documentum WebTop Open Redirect Vulnerability

EMC Documentum WebTop is a document management service. An open redirection vulnerability exists in the EMC Documentum WebTop WEB interface, which allows an attacker to construct a malicious URI, trick the user into parsing it, and redirect the user to an arbitrary WEB site for phishing attacks...

EMC Documentum CenterStage Cross-Site Scripting Vulnerability

EMC Documentum CenterStage is a document management service. A cross-site scripting vulnerability in EMC Documentum CenterStage allows remote attackers to construct malicious URIs, trick users into parsing them, and perform malicious actions in the context of the target user...

ESA-2015-123: EMC Documentum WebTop Open Redirect Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-123: EMC Documentum WebTop Open Redirect Vulnerability ESA Identifier: ESA-2015-123 CVE Identifier: CVE-2015-4529 Severity Rating: CVSS v2 Base Score: 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N Affected products: • EMC Documentum WebTop versions 6.8 and...

ESA-2015-122: EMC Documentum CenterStage Cross-site Scripting Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-122: EMC Documentum CenterStage Cross-site Scripting Vulnerability EMC Identifier: ESA-2015-122 CVE Identifier: CVE-2015-4528 Severity Rating: CVSS v2 Base Score: 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P Affected products: • EMC Documentum CenterStage...

CVE-2015-4529

Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary w...

CVE-2015-4528

Cross-site scripting XSS vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Open redirect

Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary w...

Cross site scripting

Cross-site scripting XSS vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4529

This CVE (CVE-2015-4529) covers an open redirect vulnerability in EMC Documentum client/server components, including WebTop (before 6.8P02), Administrator (before 7.2P01), Digital Assets Manager (through 6.5SP6), Web Publishers (through 6.5SP7), and Task Space (through 6.7SP2). The underlying iss...

CVE-2015-4528

EMC Documentum CenterStage is affected by a stored XSS in versions 1.2SP1 and 1.2SP2. The issue allows remote authenticated users to inject script/HTML via unspecified vectors; impact is tied to the authenticated user context. EMC’s advisory ESA-2015-122 recommends upgrading to CenterStage 1.2SP2...