CVE-2016-0881

EMC Documentum xCP is affected: versions 2.1 before patch 23 and 2.2 before patch 11 expose a DQL injection via REST requests, allowing remote authenticated attackers to obtain sensitive repository information. The root cause is improper handling of XCP REST requests, enabling execution of SQL-li...

CVE-2016-0886

CVE-2016-0886 affects EMC Documentum xCP (versions 2.1 before patch 24 and 2.2 before patch 12). The vulnerability allows remote authenticated users to disclose sensitive user-account metadata via the members/xcp_member API. Root cause is an information-disclosure issue in that API endpoint. Impa...

CVE-2016-0882

EMC Documentum xCP is affected: versions 2.1 before patch 23 and 2.2 before patch 11 are vulnerable to a XML External Entity (XXE) issue. The vulnerability enables remote authenticated users to read arbitrary files by sending a POST request containing an XML external entity declaration combined w...