794 matches found
CVE-2014-2508
CVE-2014-2508 affects EMC Documentum Content Server versions 6.7 SP1 P28, 6.7 SP2 P14, 7.0 P15, and 7.1 P05 and earlier, where an authenticated user can exploit DQL hints to perform DQL injection and bypass restrictions on database actions. The root cause is described as improper handling/validat...
CVE-2014-2506
EMC Documentum Content Server (versions 6.7 SP1 P28, 6.7 SP2 P14, 7.0 before P15, 7.1 before P05) contains a privilege-escalation vulnerability (CVE-2014-2506) exploitable by remote authenticated users to create system objects with super-user privileges and bypass data access/server action restri...
CVE-2014-2507
EMC Documentum Content Server is affected by CVE-2014-2507 (shell command injection). The vulnerability affects 6.7 SP1 before P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05, allowing remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to un...
CVE-2014-2507
EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...
CVE-2014-2507: Improper Neutralization of Special Elements used in an OS Command
EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...
CVE-2014-2508: Improper Input Validation
EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on database actions via vectors involving DQL hints...
CVE-2014-2506: Undefined Security Weakness
EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors...
CVE-2014-2503
The thumbnail proxy server in EMC Documentum Digital Asset Manager DAM 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query strin...
Design/Logic Flaw
The thumbnail proxy server in EMC Documentum Digital Asset Manager DAM 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query strin...
CVE-2014-2503
The thumbnail proxy server in EMC Documentum Digital Asset Manager DAM 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query strin...
EMC Documentum D2 Privilege Escalation (ESA-2014-045)
The remote host is running EMC Documentum D2. It is, therefore, affected by a privilege escalation vulnerability due to a flaw in the Documentum Query Language DQL engine. A remote, authenticated attacker can exploit this vulnerability to execute arbitrary DQL queries with superuser privileges. C...
CVE-2014-2503: Improper Input Validation
The thumbnail proxy server in EMC Documentum Digital Asset Manager DAM 6.5 SP3, 6.5 SP4, 6.5 SP5, and 6.5 SP6 before P13 allows remote attackers to conduct Documentum Query Language DQL injection attacks and bypass intended restrictions on querying objects via a crafted parameter in a query strin...
ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability
ESA-2014-045.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability EMC Identifier: ESA-2014-045 CVE Identifier: CVE-2014-2504 Severity: CVSSv2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: • EMC Documentum D2...
EMC Documentum D2 privilege escalation
It's possible to execute DQL Query with super-user privileges...
CVE-2014-2504
EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...
Design/Logic Flaw
EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...
CVE-2014-2504
EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...
CVE-2014-2504
EMC Documentum D2 is affected by CVE-2014-2504 across multiple releases (3.1 before P20, 3.1SP1 before P02, 4.0 before P10, 4.1 before P13, 4.2 before P01). The issue stems from a flaw in the Documentum Query Language (DQL) engine that enables an authenticated remote user to bypass access restric...
CVE-2014-2504: Undefined Security Weakness
EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...