CVSS: 9.8EPSS: 37%CPEs: 7EXPL: 3CVE-2017-5586 – OpenText Documentum D2 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2017-5586
15 Feb 2017 — OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the BeanShell (bsh) and Apache Commons Collections (ACC) libraries. OpenText Documentum D2 (anteriormente EMC Documentum D2) 4.x permite a atacantes remotos ejecutar comandos arbitrarios a través de un objeto Java serializado manipulado, relacionado con las librerías BeanShell (bsh) y Apache Commons Collections (ACC). OpenText Documentum D2 version 4.... • https://packetstorm.news/files/id/141105 • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-6644 – EMC Documentum D2 Authentication Bypass
https://notcve.org/view.php?id=CVE-2016-6644
13 Sep 2016 — EMC Documentum D2 4.5 before patch 15 and 4.6 before patch 03 allows remote attackers to read arbitrary Docbase documents by leveraging knowledge of an r_object_id value. EMC Documentum D2 4.5 en versiones anteriores a patch 15 y 4.6 en versiones anteriores a patch 03 permite a atacantes remotos leer documentos Docbase arbitrarios aprovechando el conocimiento de un valor r_object_id. EMC Documentum D2 contains fix for authentication bypass that could potentially be exploited by malicious users to compromise... • http://seclists.org/bugtraq/2016/Sep/18 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.0EPSS: 1%CPEs: 1EXPL: 0CVE-2016-0888 – EMC Documentum D2 4.6 Configuration Object
https://notcve.org/view.php?id=CVE-2016-0888
05 Apr 2016 — EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors. EMC Documentum D2 en versiones anteriores a 4.6 carece de ACLs destinadas a objetos de configuración, lo que permite a usuarios remotos autenticados modificar objetos a través de vectores no especificados. EMC Documentum D2 4.6 contains a fix for a D2 Configuration Object vulnerability that could potentially be exploited by malicious users to perform ... • http://seclists.org/bugtraq/2016/Apr/20 •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-4537 – EMC Documentum D2 Fail Open
https://notcve.org/view.php?id=CVE-2015-4537
22 Aug 2015 — Lockbox in EMC Documentum D2 before 4.5 uses a hardcoded passphrase when a server lacks a D2.Lockbox file, which makes it easier for remote authenticated users to decrypt admin tickets by locating this passphrase in a decompiled D2 JAR archive. Vulnerabilidad en Lockbox en EMC Documentum D2 anterior a 4.5, utiliza una frase de acceso embebida cuando a un servidor le falta el fichero D2.Lockbox, lo que hace que sea más fácil para los usuarios remotos autenticados descifrar tickets de administración mediante ... • http://seclists.org/bugtraq/2015/Aug/117 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2015-0547 – EMC Documentum D2 DQL Injection
https://notcve.org/view.php?id=CVE-2015-0547
02 Jul 2015 — The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors. El método de servicio D2CenterstageService.getComments en EMC Documentum D2 4.1 y 4.2 anterior a 4.2 P16 y 4.5 anterior a P03 permite a usuarios remotos autenticados realizar ataques de inyección Documentum Query Language (DQL) ... • http://seclists.org/bugtraq/2015/Jul/10 • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2015-0548 – EMC Documentum D2 DQL Injection
https://notcve.org/view.php?id=CVE-2015-0548
02 Jul 2015 — The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors. El método de servicio D2DownloadService.getDownloadUrls en EMC Documentum D2 4.1 y 4.2 anterior a 4.2 P16 y 4.5 anterior a P03 permite a usuarios remotos autenticados realizar ataques de inyección Documentum Query Language (DQL... • http://seclists.org/bugtraq/2015/Jul/10 • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0549 – EMC Documentum D2 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-0549
23 Jun 2015 — Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en EMC Documentum D2 anterior a 4.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. EMC Documentum D2 contains a cross site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected sys... • http://seclists.org/bugtraq/2015/Jun/113 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2015-0517 – EMC Documentum D2 Information Disclosure / Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-0517
04 Feb 2015 — The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file. El componente D2-API en EMC Documentum D2 3.1 hasta SP1, 4.0 y 4.1 anterior a 4.1 P22, y 4.2 anterior a P11 coloca el hash MD5 una frase de contraseña de cifrado en ficheros de registros, lo que permite a usuarios remotos autenticados obtener informació... • http://archives.neohapsis.com/archives/bugtraq/2015-02/0031.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 1%CPEs: 5EXPL: 0CVE-2015-0518 – EMC Documentum D2 Information Disclosure / Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-0518
04 Feb 2015 — The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies group permissions. El servicio Properties en el componente del servicio web D2FS en EMC Documentum D2 3.1 hasta SP1, 4.0 y 4.1 anterior a 4.1 P22, y 4.2 anterior a P11 permite a usuarios remotos autenticados obtener privilegios de superusuario a través de una ... • http://archives.neohapsis.com/archives/bugtraq/2015-02/0031.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 1%CPEs: 5EXPL: 0CVE-2014-2515 – EMC Documentum D2 Privilege Escalation
https://notcve.org/view.php?id=CVE-2014-2515
19 Aug 2014 — EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket. EMC Documentum D2 3.1 anterior a P24, 3.1SP1 anterior a P02, 4.0 anterior a P11, 4.1 anterior a P16, y 4.2 anterior a P05 no restringe debidamente los tickets proporcionados por D2GetAdminTicketMethod y D2RefreshCac... • http://secunia.com/advisories/60565 • CWE-264: Permissions, Privileges, and Access Controls •