EUVD-2015-0553

Malware in sbrugna...

CVE-2017-14755: Improper Neutralization of Input During Web Page Generation

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to Cross-Site Scripting: /xAdmin/html/XPressoDoc, parameter: categoryId...

CVE-2017-14756: Improper Neutralization of Input During Web Page Generation

OpenText Document Sciences xPression formerly EMC Document Sciences xPression v4.5SP1 Patch 13 older versions might be affected as well is prone to Cross-Site Scripting: /xAdmin/html/Deployment catid...

PT-2017-13673

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue allows for SQL Injection, specifically through the /xAdmin/html/cm doclist view uc.jsp API endpoint, with the vulnerable parameter being documentId. ...

PT-2017-13670

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue is related to Cross-Site Scripting. The "/xAdmin/html/XPressoDoc" API endpoint is vulnerable, specifically the categoryId parameter. Recommendations...

PT-2017-13671

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue is related to Cross-Site Scripting. The /xAdmin/html/Deployment API endpoint is affected, specifically the cat id variable. Recommendations For...

PT-2017-13669

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue allows for Arbitrary File Read. An attacker must first authenticate to the application. The "/xAdmin/html/cm datasource group xsd.jsp" API endpoint i...

CVE-2015-0540

SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression 4.2 before P44 and 4.5 SP1 before P03 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-0540: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression 4.2 before P44 and 4.5 SP1 before P03 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

EMC Document Sciences xPression SQL Injection Vulnerability

EMC Document Sciences is a customer communications management solution. A SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression versions 4.2, 4.5 SP1 can be exploited by remote attackers to access or modify information on an affected system by executing SQL comman...

QAEngine Theme - Privilege Escalation

QAEngine vulnerability allows an attacker to have an administrator account on the target's website. http://www.example.com/wp-admin/admin-ajax.php?action=ae-sync-user&method=create&userlogin=xADMIN&userpass=xPASS&role=administrator...

CVE-2013-6173

Multiple cross-site request forgery CSRF vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to...

CVE-2013-6175

Multiple cross-site scripting XSS vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to inject...

CVE-2013-6174

EMC Document Sciences xPression contains an open redirect vulnerability (CVE-2013-6174) in the xAdmin application (and related xDashboard context) that could be exploited to redirect users to arbitrary sites for phishing. Affected versions are 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5...

CVE-2013-6173

EMC Document Sciences xPression is affected by CSRF vulnerabilities (CVE-2013-6173) in xAdmin/xDashboard. Affected product lines: Enterprise Edition Publish Engine and Compuset Engine, and Documentum Edition. Versions: 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05. Impact:...

CVE-2013-6175: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to inject...

CVE-2013-6176: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote authenticated users to execute...

CVE-2013-6173: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to...

PT-2013-5960

Name of the Vulnerable Software and Affected Versions EMC Document Sciences xPression versions 4.1 SP1 before Patch 47 EMC Document Sciences xPression versions 4.2 before Patch 26 EMC Document Sciences xPression versions 4.5 before Patch 05 Description The issue allows remote attackers to inject...

PT-2013-5961

Name of the Vulnerable Software and Affected Versions EMC Document Sciences xPression versions 4.1 before Patch 47 EMC Document Sciences xPression versions 4.2 before Patch 26 EMC Document Sciences xPression versions 4.5 before Patch 05 Description The issue allows remote authenticated users to...