Unscored severity · published Jun 28, 2015
CVE-2015-0549
Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DD
Documentum D2 · Emc
through 4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0549
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0549
seclists.org
http://seclists.org/bugtraq/2015/Jun/113
www.securitytracker.com
http://www.securitytracker.com/id/1032693
More from Documentum D2
8.8
CVE-2016-0888
EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors
6.3
CVE-2016-9873
EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected…
6.1
CVE-2016-9872
EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has Reflected Cross-Site Scripting Vulnerabilities that could potentially be exploited by malicious users to…
5.3
CVE-2016-6644
EMC Documentum D2 4.5 before patch 15 and 4.6 before patch 03 allows remote attackers to read arbitrary Docbase documents by leveraging knowledge of an r_object_id value
–
CVE-2015-4537
Lockbox in EMC Documentum D2 before 4.5 uses a hardcoded passphrase when a server lacks a D2.Lockbox file, which makes it easier for remote authenticated users to decrypt admin…