CVE-2008-5225

CVE-2008-5225 affects Xerox DocuShare 6 and earlier. The vulnerability is a cross-site scripting (XSS) flaw in the dsweb servlet where unsanitized PATH_INFO is echoed in dynamic HTML, enabling remote injection of script or HTML via the default URI under SearchResults/ and Services/ in dsdn/dsweb/...

CVE-2014-3138

CVE-2014-3138 describes an SQL injection in Xerox DocuShare. The vulnerability affects DocuShare before 6.53 Patch 6 Hotfix 2, 6.6.1 Update 1 before Hotfix 24, and 6.6.1 Update 2 before Hotfix 3, allowing remote authenticated users to execute arbitrary SQL commands via PATH_INFO to /docushare/dsw...