Page 55 of 419 results (0.010 seconds)

CVSS: 5.8EPSS: 0%CPEs: 9EXPL: 0

CVE-2013-6174

https://notcve.org/view.php?id=CVE-2013-6174

Multiple open redirect vulnerabilities in xAdmin in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters. Múltiples vulnerabilidades de redirección abierta en xAdmin en EMC Document Sciences xPression 4.1 SP1 anterior a la versión Patch 47, 4.2 anterior a Patch 26, y 4.5 anterior a la versión Patch 05, tal y como se usa en Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, permite a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y llevar a cabo ataques de phishing a través de vectores sin especificar. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html http://www.kb.cert.org/vuls/id/346982 http://www.securityfocus.com/bid/63810 http://www.securitytracker.com/id/1029384 • CWE-20: Improper Input Validation •

CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0

CVE-2013-6173

https://notcve.org/view.php?id=CVE-2013-6173

Multiple cross-site request forgery (CSRF) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to hijack the authentication of administrators for requests that perform administrative actions in (1) xAdmin or (2) xDashboard. Múltiples vulnerabilidades de CSRF en EMC Document Sciences xPression 4.1 SP1 anterior a la versión Patch 47, 4.2 anterior a Patch 26, y 4.5 anterior a la versión Patch 05, tal y como se usa en Documentum Edition, Enterprise Edition Publish Engine, y Enterprise Edition Compuset Engine, permite a atacantes remotos secuestrar la autenticación de peticiones de administrador que realicen acciones administrativas en (1) xAdmin o (2) xDashboard. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html http://osvdb.org/99985 http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html http://www.kb.cert.org/vuls/id/346982 http://www.securitytracker.com/id/1029384 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.5EPSS: 0%CPEs: 9EXPL: 0

CVE-2013-6176

https://notcve.org/view.php?id=CVE-2013-6176

Multiple SQL injection vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote authenticated users to execute arbitrary SQL commands via unspecified input to a (1) xAdmin or (2) xDashboard form. Vulnerabilidades de inyección SQL en EMC Document Sciences xPression 4.1 SP1 anterior a la versión Patch 47, 4.2 anterior a Patch 26, y 4.5 anterior a la versión Patch 05, tal y como se usa en Documentum Edition, Enterprise Edition Publish Engine, y Enterprise Edition Compuset Engine, permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de entradas sin especificar hacia (1) xAdmin o (2) xDashboard. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html http://www.kb.cert.org/vuls/id/346982 http://www.securitytracker.com/id/1029384 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 3.5EPSS: 0%CPEs: 9EXPL: 0

CVE-2013-6177

https://notcve.org/view.php?id=CVE-2013-6177

Directory traversal vulnerability in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allows remote authenticated users to read arbitrary files by leveraging xDashboard access. Vulnerabilidad de recorrido de directorio en EMC Document Sciences xPression 4.1 SP1 anterior a Patch 47, 4.2 anterior a Patch 26, y 4.5 anterior a Patch 05, tal y como se usa en Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, permite a usuarios remotos autenticados leer archivos arbitrarios mediante el aprovechamiento de acceso a xDashboard. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html http://www.kb.cert.org/vuls/id/346982 http://www.securitytracker.com/id/1029384 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0

CVE-2013-6175

https://notcve.org/view.php?id=CVE-2013-6175

Multiple cross-site scripting (XSS) vulnerabilities in EMC Document Sciences xPression 4.1 SP1 before Patch 47, 4.2 before Patch 26, and 4.5 before Patch 05, as used in Documentum Edition, Enterprise Edition Publish Engine, and Enterprise Edition Compuset Engine, allow remote attackers to inject arbitrary web script or HTML via unspecified input to a (1) xAdmin or (2) xDashboard form. Múltiples vulnerabilidades de XSS en EMC Document Sciences xPression 4.1 SP1 anterior a la versión Patch 47, 4.2 anterior a Patch 26, y 4.5 anterior a la versión Patch 05, tal y como se usa en Documentum Edition, Enterprise Edition Publish Engine, y Enterprise Edition Compuset Engine, permite a atacantes remotos inyectar script web arbitrario o HTML a través de entradas hacia formularios (1) xAdmin o (2) xDashboard. • http://archives.neohapsis.com/archives/bugtraq/2013-11/0095.html http://packetstormsecurity.com/files/124070/EMC-Document-Sciences-xPression-XSS-CSRF-Redirect-SQL-Injection.html http://www.kb.cert.org/vuls/id/346982 http://www.securitytracker.com/id/1029384 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •