ESA-2014-057: EMC Documentum Foundation Services (DFS) XML External Entity (XXE) Vulnerability

ESA-2014-057.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-057: EMC Documentum Foundation Services DFS XML External Entity XXE Vulnerability EMC Identifier: ESA-2014-057 CVE Identifier: CVE-2014-2510 Severity Rating: CVSS v2 Base Score: 8 AV:N/AC:L/Au:S/C:C/I:P/A:P Affected products:...

SEC Consult SA-20140701-0 :: Stored cross-site scripting vulnerabilities in EMC Documentum eRoom

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140701-0 ======================================================================= title: Stored cross-site scripting vulnerabilities product: EMC Documentum eRoom vulnerable version: 7.4.3, 7.4.4, 7.4.4...

CVE-2014-2510

The JAXB XML parser in EMC Documentum Foundation Services DFS 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via an external entity...

CVE-2014-2514

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently...

Authorization

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently...

Authorization

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script...

Xxe

The JAXB XML parser in EMC Documentum Foundation Services DFS 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via an external entity...

CVE-2014-2510

The JAXB XML parser in EMC Documentum Foundation Services DFS 6.6 before P39, 6.7 SP1 before P28, and 6.7 SP2 before P15, as used in My Documentum for Desktop, My Documentum for Microsoft Outlook, and CenterStage, allows remote authenticated users to read arbitrary files via an external entity...

CVE-2014-2513

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script...

CVE-2014-2513

OpenText/OpenText Documentum Content Server is affected (EMC Documentum Content Server) prior to versions 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06. The root cause is an inadequate authorization check in the dm_bp_transition docbase method, allowing remote authenticated ...

CVE-2014-2510

CVE-2014-2510 concerns an XXE vulnerability in the JAXB XML parser used by EMC Documentum Foundation Services (DFS). Affected products and versions (as cited in ESA-2014-057 and NVD/NVD mirror entries) include EMC DFS 6.6 prior to P39, 6.7 SP1 prior to P28, and 6.7 SP2 prior to P15, as well as My...

CVE-2014-2514

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P15, 7.0 before P15, and 7.1 before P06 does not properly check authorization and does not properly restrict object types, which allows remote authenticated users to run save RPC commands with super-user privileges, and consequently...

EMC Documentum eRoom Stored Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140701-0 ======================================================================= title: Stored cross-site scripting vulnerabilities product: EMC Documentum eRoom vulnerable version: 7.4.3, 7.4.4, 7.4.4...

CVE-2014-2512

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2512

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum eRoom 7.4.3, 7.4.4 before P19, and 7.4.4 SP1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-2512

EMC Documentum eRoom contains multiple cross-site scripting (XSS) vulnerabilities (CVE-2014-2512) in versions 7.4.3, 7.4.4 before P19, and 7.4.4 SP1. The issue affects authenticated users and allows injection of arbitrary HTML/script via unspecified vectors. Fixed versions/mitigations per SEC Con...

ESA-2014-046: EMC Documentum Content Server Multiple Vulnerabilities

ESA-2014-046.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-046: EMC Documentum Content Server Multiple Vulnerabilities EMC Identifier: ESA-2014-046 CVE Identifier: CVE-2014-2506, CVE-2014-2507, CVE-2014-2508 Severity Rating: CVSS v2 Base Score: See below for individual scores Affecte...

ESA-2014-024: EMC Documentum Digital Asset Manager Blind DQL Injection Vulnerability

ESA-2014-024.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-024: EMC Documentum Digital Asset Manager Blind DQL Injection Vulnerability EMC Identifier: ESA-2014-024 CVE Identifier: CVE-2014-2503 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: • E...

CVE-2014-2507

EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...