EUVD-2007-3246

Malware in sbrugna...

CVE-2007-3255

Multiple cross-site request forgery CSRF vulnerabilities in Xythos Enterprise Document Manager XEDM before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to execute commands as arbitrary users via 1 a saved Workflow name or 2 the Content-Type HTTP header. NOTE: item 2 also...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Xythos Enterprise Document Manager XEDM before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to inject arbitrary web script or HTML via 1 a saved Workflow name; 2 a Workflow name, related to deletion of a Workflow template...

CVE-2007-3256

Xythos Enterprise Document Manager XEDM, Digital Locker XDL, and possibly WebFile Server before 6.0.46.1 allow remote authenticated users to associate arbitrary Content-Type HTTP headers with documents, which might facilitate malware distribution...

CVE-2007-3256

Xythos Enterprise Document Manager XEDM, Digital Locker XDL, and possibly WebFile Server before 6.0.46.1 allow remote authenticated users to associate arbitrary Content-Type HTTP headers with documents, which might facilitate malware distribution...

CVE-2007-3254

Multiple cross-site scripting XSS vulnerabilities in Xythos Enterprise Document Manager XEDM before 5.0.25.8, and 6.x before 6.0.46.1, allow remote authenticated users to inject arbitrary web script or HTML via 1 a saved Workflow name; 2 a Workflow name, related to deletion of a Workflow template...

CVE-2007-3256

CVE-2007-3256 affects Xythos Enterprise Document Manager (XEDM), Xythos Digital Locker (XDL), and possibly WebFile Server prior to 6.0.46.1. The root issue is insufficient server-side validation of the Content-Type value set by remote authenticated users, allowing them to associate arbitrary Cont...

CVE-2007-3254

CVE-2007-3254 covers multiple stored and reflected XSS vulnerabilities in Xythos Enterprise Document Manager (XEDM) versions prior to 5.0.25.8 and 6.x prior to 6.0.46.1. The issues enable remote authenticated users to inject arbitrary HTML/JavaScript via (1) a saved Workflow name; (2) a Workflow ...