CVE-2013-6175

https://notcve.org/view.php?id=CVE-2013-6175

Multiple cross-site scripting (XSS) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to inject arbitrary web script or HTML via unspecified input to a (1) xAdmin or (2) xDashboard form. Múltiples vulnerabilidades de XSS en EMC Document Sciences xPression 4.1 SP1 anterior a la versión Patch 47, 4.2 anterior a Patch 26, y 4.5 anterior a la versión Patch 05, tal y como se usa en Documentum Edition, Enterprise Edition Publish Engine, y Enterprise Edition Compuset Engine, permite a atacantes remotos inyectar script web arbitrario o HTML a través de entradas hacia formularios (1) xAdmin o (2) xDashboard. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html http://www.kb.cert.org/vuls/id/346982 http://www.securitytracker.com/id/1029384 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •