EMC Documentum D2 privilege escalation

It's possible to execute DQL Query with super-user privileges...

ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability

ESA-2014-045.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-045: EMC Documentum D2 Arbitrary DQL Query Execution Vulnerability EMC Identifier: ESA-2014-045 CVE Identifier: CVE-2014-2504 Severity: CVSSv2 Base Score: 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Affected products: • EMC Documentum D2...

CVE-2014-2504

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

Design/Logic Flaw

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

CVE-2014-2504

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

CVE-2014-2504

EMC Documentum D2 is affected by CVE-2014-2504 across multiple releases (3.1 before P20, 3.1SP1 before P02, 4.0 before P10, 4.1 before P13, 4.2 before P01). The issue stems from a flaw in the Documentum Query Language (DQL) engine that enables an authenticated remote user to bypass access restric...

PT-2014-4742

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 before P20 EMC Documentum D2 version 3.1 SP1 before P02 EMC Documentum D2 version 4.0 before P10 EMC Documentum D2 version 4.1 before P13 EMC Documentum D2 version 4.2 before P01 Description The issue allows remo...

CVE-2014-2504: Undefined Security Weakness

EMC Documentum D2 3.1 before P20, 3.1 SP1 before P02, 4.0 before P10, 4.1 before P13, and 4.2 before P01 allows remote authenticated users to bypass intended access restrictions and execute arbitrary Documentum Query Language DQL queries by calling 1 a core method or 2 a D2FS web-service method...

[SECURITY] Fedora 14 Update: php-doctrine-Doctrine-1.2.4-1.fc14

Doctrine is an object relational mapper ORM for PHP 5.2.3+ that sits on t op of a powerful database abstraction layer DBAL. One of its key features is the option to write database queries in a proprietary object oriented SQL diale ct called Doctrine Query Language DQL, inspired by Hibernates HQL...

[SECURITY] Fedora 15 Update: php-doctrine-Doctrine-1.2.4-1.fc15

Doctrine is an object relational mapper ORM for PHP 5.2.3+ that sits on t op of a powerful database abstraction layer DBAL. One of its key features is the option to write database queries in a proprietary object oriented SQL diale ct called Doctrine Query Language DQL, inspired by Hibernates HQL...