CVE-2014-2510

CVE-2014-2510 concerns an XXE vulnerability in the JAXB XML parser used by EMC Documentum Foundation Services (DFS). Affected products and versions (as cited in ESA-2014-057 and NVD/NVD mirror entries) include EMC DFS 6.6 prior to P39, 6.7 SP1 prior to P28, and 6.7 SP2 prior to P15, as well as My...

CVE-2014-2514

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently...

EMC Documentum eRoom Stored Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140701-0 ======================================================================= title: Stored cross-site scripting vulnerabilities product: EMC Documentum eRoom vulnerable version: 7.4.3, 7.4.4, 7.4.4...

CVE-2014-2512

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

EMC Captiva QuickScan Pro 4.6 SP1 and EMC Documentum ApllicationXtender Desktop 5.4 (keyhelp.ocx 1.2.312) - Remote Exploit

No description provided by source. !-- EMC multiple products KeyWorks KeyHelp Module keyhelp.ocx 1.2.312 remote buffer overflow exploit ie8 xp sp3 by Nine:Situations:Group::pyrokinesis site: http://retrogod.altervista.org/ tested products: EMC Captiva QuickScan Pro 4.6 sp1 EMC Documentum...

CVE-2014-2512

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2512

EMC Documentum eRoom contains multiple cross-site scripting (XSS) vulnerabilities (CVE-2014-2512) in versions 7.4.3, 7.4.4 before P19, and 7.4.4 SP1. The issue affects authenticated users and allows injection of arbitrary HTML/script via unspecified vectors. Fixed versions/mitigations per SEC Con...

ESA-2014-046: EMC Documentum Content Server Multiple Vulnerabilities

ESA-2014-046.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-046: EMC Documentum Content Server Multiple Vulnerabilities EMC Identifier: ESA-2014-046 CVE Identifier: CVE-2014-2506, CVE-2014-2507, CVE-2014-2508 Severity Rating: CVSS v2 Base Score: See below for individual scores Affecte...

ESA-2014-024: EMC Documentum Digital Asset Manager Blind DQL Injection Vulnerability

ESA-2014-024.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-024: EMC Documentum Digital Asset Manager Blind DQL Injection Vulnerability EMC Identifier: ESA-2014-024 CVE Identifier: CVE-2014-2503 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: • E...

CVE-2014-2507

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...

CVE-2014-2508

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on database actions via vectors involving DQL hints...

CVE-2014-2506

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors...

Design/Logic Flaw

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...

Design/Logic Flaw

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on database actions via vectors involving DQL hints...

Design/Logic Flaw

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors...

CVE-2014-2506

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors...

CVE-2014-2508

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on database actions via vectors involving DQL hints...

CVE-2014-2507

EMC Documentum Content Server is affected by CVE-2014-2507 (shell command injection). The vulnerability affects 6.7 SP1 before P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05, allowing remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to un...

CVE-2014-2508

CVE-2014-2508 affects EMC Documentum Content Server versions 6.7 SP1 P28, 6.7 SP2 P14, 7.0 P15, and 7.1 P05 and earlier, where an authenticated user can exploit DQL hints to perform DQL injection and bypass restrictions on database actions. The root cause is described as improper handling/validat...