CVE-2014-4636

Cross-site request forgery CSRF vulnerability in EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to hijack the authentication of arbitrary users for requests that perform Docbase operations...

CVE-2014-4636

EMC Documentum Web Development Kit (WDK) prior to version 6.8 is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2014-4636). The issue allows an attacker to trick authenticated users into performing Docbase operations with their privileges by visiting a malicious link or page, ...

CVE-2014-4637

EMC Documentum Web Development Kit (WDK) prior to version 6.8 contains a URL Redirection vulnerability (CVE-2014-4637). The issue arises from an unvalidated parameter allowing a remote attacker to redirect users to arbitrary sites, enabling phishing-like redirects. ESA-2014-180 summarizes related...

CVE-2014-4638

EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to conduct frame-injection attacks and obtain sensitive information via unspecified vectors...

CVE-2014-4635

Multiple cross-site scripting XSS vulnerabilities in EMC Documentum Web Development Kit WDK before 6.8 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-4639

CVE-2014-4639 affects EMC Documentum Web Development Kit (WDK) before 6.8. The issue is insufficient randomness in a Webtop component parameter, enabling remote attackers to predict the parameter and carry out phishing via brute-force attempts. The ESA-2014-180 advisory lists this under multiple ...

CVE-2014-4635

EMC Documentum Web Development Kit (WDK) before 6.8 contains multiple Cross-Site Scripting (XSS) vulnerabilities (CVE-2014-4635). The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, potentially impacting users in the context of authenticated sessions....

CVE-2014-4638

EMC Documentum Web Development Kit (WDK) prior to version 6.8 contains a frame-injection vulnerability (CVE-2014-4638). The issue can allow remote attackers to induce the user to load an attacker-controlled page in a frame and potentially harvest sensitive information, with the documented base CV...

CVE-2014-4637

Open redirect vulnerability in EMC Documentum Web Development Kit WDK before 6.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

CVE-2014-4639

EMC Documentum Web Development Kit WDK before 6.8 does not properly generate random numbers for a certain parameter related to Webtop components, which makes it easier for remote attackers to conduct phishing attacks via brute-force attempts to predict the parameter value...

EMC Documentum Web Development Kit (WDK) URL Redirection Vulnerability

The EMC Documentum Web Development Kit WDK is a Web development kit. The EMC Documentum Web Development Kit WDK contains a URL redirection vulnerability that can be exploited by an attacker to construct URLs that contain malicious Web sites, which may be redirected to an attacker-controlled Web...

Multiple Cross-Site Scripting Vulnerabilities in EMC Documentum Web Development Kit (WDK)

The EMC Documentum Web Development Kit WDK is a Web development kit. The EMC Documentum Web Development Kit WDK contains multiple cross-site scripting vulnerabilities that could be exploited by an attacker to execute arbitrary script code in a browser without the user's knowledge in an affected...

EMC RSA BSAFE triple handhsake TLS attacks

Certificate is not validated on renegotiation...

ESA-2014-179: EMC Replication Manager and EMC AppSync Unquoted Service Path Enumeration Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-179: EMC Replication Manager and EMC AppSync Unquoted Service Path Enumeration Vulnerability EMC Identifier: ESA-2014-179 CVE Identifier: CVE-2014-4634 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected products: EMC...

EMC Replication Manager / EMC AppSync privilege escalation

Registry path is stored without quotes...

CVE-2014-4634

Unquoted Windows search path vulnerability in EMC Replication Manager through 5.5.2 and AppSync before 2.1.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character...

Design/Logic Flaw

EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.6 and RSA BSAFE SSL-J before 6.1.4 do not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session...

CVE-2014-4630

EMC RSA BSAFE Micro Edition Suite MES 4.0.x before 4.0.6 and RSA BSAFE SSL-J before 6.1.4 do not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session...

Design/Logic Flaw

Unquoted Windows search path vulnerability in EMC Replication Manager through 5.5.2 and AppSync before 2.1.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character...

CVE-2014-4634

Unquoted Windows search path vulnerability in EMC Replication Manager through 5.5.2 and AppSync before 2.1.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character...