CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6176
https://notcve.org/view.php?id=CVE-2013-6176
Multiple SQL injection vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote authenticated users to execute arbitrary SQL commands via unspecified input to a (1) xAdmin or (2) xDashboard form. Vulnerabilidades de inyección SQL en EMC Document Sciences xPression 4.1 SP1 anterior a la versión Patch 47, 4.2 anterior a Patch 26, y 4.5 anterior a la versión Patch 05, tal y como se usa en Documentum Edition, Enterprise Edition Publish Engine, y Enterprise Edition Compuset Engine, permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de entradas sin especificar hacia (1) xAdmin o (2) xDashboard. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html http://www.kb.cert.org/vuls/id/346982 http://www.securitytracker.com/id/1029384 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.5EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6177
https://notcve.org/view.php?id=CVE-2013-6177
Directory traversal vulnerability in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allows remote authenticated users to read arbitrary files by leveraging xDashboard access. Vulnerabilidad de recorrido de directorio en EMC Document Sciences xPression 4.1 SP1 anterior a Patch 47, 4.2 anterior a Patch 26, y 4.5 anterior a Patch 05, tal y como se usa en Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, permite a usuarios remotos autenticados leer archivos arbitrarios mediante el aprovechamiento de acceso a xDashboard. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html http://www.kb.cert.org/vuls/id/346982 http://www.securitytracker.com/id/1029384 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6175
https://notcve.org/view.php?id=CVE-2013-6175
Multiple cross-site scripting (XSS) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to inject arbitrary web script or HTML via unspecified input to a (1) xAdmin or (2) xDashboard form. Múltiples vulnerabilidades de XSS en EMC Document Sciences xPression 4.1 SP1 anterior a la versión Patch 47, 4.2 anterior a Patch 26, y 4.5 anterior a la versión Patch 05, tal y como se usa en Documentum Edition, Enterprise Edition Publish Engine, y Enterprise Edition Compuset Engine, permite a atacantes remotos inyectar script web arbitrario o HTML a través de entradas hacia formularios (1) xAdmin o (2) xDashboard. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html http://www.kb.cert.org/vuls/id/346982 http://www.securitytracker.com/id/1029384 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •