CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-14758 – OpenText Document Sciences xPression 4.5SP1 Patch 13 - 'documentId' SQL Injection
https://notcve.org/view.php?id=CVE-2017-14758
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection: /xAdmin/html/cm_doclist_view_uc.jsp, parameter: documentId. In order for this vulnerability to be exploited, an attacker must authenticate to the application first. OpenText Document Sciences xPression (anteriormente conocido como EMC Document Sciences xPression) v4.5SP1 Patch 13 (otras versiones más antiguas también podrían verse afectadas) es propenso a una inyección SQL: /xAdmin/html/cm_doclist_view_uc.jsp, parámetro: documentId. Para que esta vulnerabilidad sea explotada, un atacante debe autenticarse antes en la aplicación. • https://www.exploit-db.com/exploits/42940 http://seclists.org/fulldisclosure/2017/Oct/23 https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14759 – OpenText Document Sciences xPression 4.5SP1 Patch 13 XML Injection
https://notcve.org/view.php?id=CVE-2017-14759
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to an XML External Entity vulnerability: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. An unauthenticated user is able to read directory listings or system files, or cause SSRF or Denial of Service. OpenText Document Sciences xPression (anteriormente conocido como EMC Document Sciences xPression) v4.5SP1 Patch 13 (otras versiones más antiguas también podrían verse afectadas) es propenso a una vulnerabilidad de XML External Entity: /xFramework/services/QuickDoc.QuickDocHttpSoap11Endpoint/. Un usuario sin autenticar puede leer listas de directorios o archivos del sistema, así como provocar SSRF o una denegación de servicio (DoS).< OpenText Document Sciences xPression version 4.5SP1 Patch 13 suffers from an XML external entity injection vulnerability. • http://seclists.org/fulldisclosure/2017/Sep/97 https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-14756 – OpenText Document Sciences xPression 4.5SP1 Patch 13 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2017-14756
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Cross-Site Scripting: /xAdmin/html/Deployment (cat_id). OpenText Document Sciences xPression (anteriormente conocido como EMC Document Sciences xPression) v4.5SP1 Patch 13 (otras versiones más antiguas también podrían verse afectadas) es propenso a Cross-Site Scripting (XSS): /xAdmin/html/Deployment (cat_id). OpenText Document Sciences xPression version 4.5SP1 Patch 13 suffers from a cross site scripting vulnerability in the Deployment functionality. • http://seclists.org/fulldisclosure/2017/Sep/96 https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-14755 – OpenText Document Sciences xPression 4.5SP1 Patch 13 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2017-14755
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Cross-Site Scripting: /xAdmin/html/XPressoDoc, parameter: categoryId. OpenText Document Sciences xPression (anteriormente conocido como EMC Document Sciences xPression) v4.5SP1 Patch 13 (otras versiones más antiguas también podrían verse afectadas) es propenso a Cross-Site Scripting (XSS): /xAdmin/html/XPressoDoc, parámetro: categoryId. OpenText Document Sciences xPression version 4.5SP1 Patch 13 suffers from a cross site scripting vulnerability in the XPressoDoc functionality. • http://seclists.org/fulldisclosure/2017/Sep/95 https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14754 – OpenText Document Sciences xPression 4.5SP1 Patch 13 Arbitrary File Read
https://notcve.org/view.php?id=CVE-2017-14754
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to Arbitrary File Read: /xAdmin/html/cm_datasource_group_xsd.jsp, parameter: xsd_datasource_schema_file filename. In order for this vulnerability to be exploited, an attacker must authenticate to the application first. OpenText Document Sciences xPression (anteriormente conocido como EMC Document Sciences xPression) v4.5SP1 Patch 13 (otras versiones más antiguas también podrían verse afectadas) es propenso a una lectura de archivos arbitrarios: /xAdmin/html/cm_datasource_group_xsd.jsp, parámetro: xsd_datasource_schema_file filename. Para que esta vulnerabilidad sea explotada, un atacante debe autenticarse antes en la aplicación. OpenText Document Sciences xPression version 4.5SP1 Patch 13 suffers from an arbitrary file read vulnerability. • http://seclists.org/fulldisclosure/2017/Sep/92 https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •