CVE-2014-2521: Exposure of Sensitive Information to an Unauthorized Actor

EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to read sensitive object metadata via an RPC command...

CVE-2014-2511: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the 1 startat or 2 entryId parameter...

CVE-2014-2518: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in EMC Documentum WDK before 6.7SP1 P28 and 6.7SP2 before P15 allow remote attackers to hijack the authentication of arbitrary users...

CVE-2014-2515: Undefined Security Weakness

EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket...

CVE-2014-4618: Undefined Security Weakness

EMC Documentum Content Server before 6.7 SP2 P16 and 7.x before 7.1 P07 allows remote authenticated users to gain privileges via a user-created system object...

ESA-2014-060: EMC Documentum eRoom Multiple Cross-Site Scripting Vulnerabilities

ESA-2014-060.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-060: EMC Documentum eRoom Multiple Cross-Site Scripting Vulnerabilities EMC Identifier: ESA-2014-060 CVE Identifier: CVE-2014-2512 Severity Rating: CVSS v2 Base Score: 8 AV:N/AC:L/Au:S/C:C/I:P/A:P Affected products: • EMC...

ESA-2014-064: EMC Documentum Content Server Privilege Escalation Vulnerabilities

ESA-2014-064.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-064: EMC Documentum Content Server Privilege Escalation Vulnerabilities EMC Identifier: ESA-2014-064 CVE Identifier: CVE-2014-2513, CVE-2014-2514 Severity Rating: CVSS v2 Base Score: Refer below for scores for each CVE...

ESA-2014-057: EMC Documentum Foundation Services (DFS) XML External Entity (XXE) Vulnerability

ESA-2014-057.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-057: EMC Documentum Foundation Services DFS XML External Entity XXE Vulnerability EMC Identifier: ESA-2014-057 CVE Identifier: CVE-2014-2510 Severity Rating: CVSS v2 Base Score: 8 AV:N/AC:L/Au:S/C:C/I:P/A:P Affected products:...

SEC Consult SA-20140701-0 :: Stored cross-site scripting vulnerabilities in EMC Documentum eRoom

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140701-0 ======================================================================= title: Stored cross-site scripting vulnerabilities product: EMC Documentum eRoom vulnerable version: 7.4.3, 7.4.4, 7.4.4...

CVE-2014-2510

The JAXB XML parser in EMC Documentum Foundation Services DFS 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via an external entity...

CVE-2014-2514

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently...

Authorization

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script...

Authorization

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently...

Xxe

The JAXB XML parser in EMC Documentum Foundation Services DFS 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via an external entity...

CVE-2014-2510

The JAXB XML parser in EMC Documentum Foundation Services DFS 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via an external entity...

CVE-2014-2513

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script...

CVE-2014-2513

OpenText/OpenText Documentum Content Server is affected (EMC Documentum Content Server) prior to versions 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06. The root cause is an inadequate authorization check in the dm_bp_transition docbase method, allowing remote authenticated ...

CVE-2014-2514

CVE-2014-2514 affects EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06. The issue arises from improper authorization checks and insufficient restriction of object types, allowing remote authenticated users to run save RPC commands with super...

CVE-2014-2510

CVE-2014-2510 concerns an XXE vulnerability in the JAXB XML parser used by EMC Documentum Foundation Services (DFS). Affected products and versions (as cited in ESA-2014-057 and NVD/NVD mirror entries) include EMC DFS 6.6 prior to P39, 6.7 SP1 prior to P28, and 6.7 SP2 prior to P15, as well as My...

CVE-2014-2514

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently...