Vulnerabilities > EMC > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-03-15 | CVE-2012-0404 | Cross-Site Scripting vulnerability in EMC Documentum Eroom Cross-site scripting (XSS) vulnerability in EMC Documentum eRoom before 7.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2012-02-06 | CVE-2012-0396 | Permissions, Privileges, and Access Controls vulnerability in EMC Documentum Xplore 1.0/1.1/1.2 EMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not properly enforce the requirement for BROWSE permission, which allows remote authenticated users to determine the existence of an object, or read object metadata, via a search. | 4.0 |
| 2012-02-02 | CVE-2011-4144 | Unspecified vulnerability in EMC Documentum Content Server 6.0, 6.5 before SP2 P02, 6.5 SP3 before SP3 P02, and 6.6 before P02 allows local users to obtain "highest super user privileges" by leveraging system administrator privileges. | 6.8 |
| 2011-12-14 | CVE-2011-2742 | Permissions, Privileges, and Access Controls vulnerability in EMC RSA Adaptive Authentication On-Premise 6.0.2.1 EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application restrictions via a mobile device. | 6.8 |
| 2011-12-14 | CVE-2011-2741 | Permissions, Privileges, and Access Controls vulnerability in EMC RSA Adaptive Authentication On-Premise 6.0.2.1 EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement Device Recovery and Device Identification, which might allow remote attackers to bypass intended security restrictions on a (1) previously non-registered device or (2) registered device by sending unspecified "data elements." | 6.8 |
| 2011-08-01 | CVE-2011-1744 | Permissions, Privileges, and Access Controls vulnerability in EMC Captiva Einput EMC Captiva eInput 2.1.1 before 2.1.1.37 does not restrict the origin of calls to ActiveX functions, which allows remote attackers to read arbitrary files or cause a denial of service via a crafted web site. | 5.8 |
| 2011-08-01 | CVE-2011-1743 | Cross-Site Scripting vulnerability in EMC Captiva Einput Cross-site scripting (XSS) vulnerability in EMC Captiva eInput 2.1.1 before 2.1.1.37 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2011-05-05 | CVE-2011-1423 | Cross-Site Scripting vulnerability in EMC Data Loss Prevention Enterprise Manager 8.0/8.5 Cross-site scripting (XSS) vulnerability in RSA Data Loss Prevention (DLP) Enterprise Manager 8.x before 8.5 SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2011-04-22 | CVE-2011-1422 | Cross-Site Scripting vulnerability in EMC RSA Adaptive Authentication On-Premise Cross-site scripting (XSS) vulnerability in an unspecified Shockwave Flash file in EMC RSA Adaptive Authentication On-Premise (AAOP) 2.x, 5.7.x, and 6.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors. | 4.3 |
| 2011-04-22 | CVE-2011-1421 | Permissions, Privileges, and Access Controls vulnerability in EMC Networker EMC NetWorker 7.5.x before 7.5.4.3 and 7.6.x before 7.6.1.5, when the client push feature is enabled, uses weak permissions for an unspecified file, which allows local users to gain privileges via unknown vectors. | 6.9 |