Pawel Gocyla

The issue is related to an XML External Entity vulnerability, which could allow the control of a web browser and hijacking of user sessions.

The issue is a Reflected Cross-Site Scripting vulnerability that could allow disclosure of confidential data.

The issue is related to insufficient access control in the Portal component of Oracle PeopleSoft Enterprise PeopleTools, allowing an unauthenticated attacker with logon to the infrastructure to compromise PeopleSoft Enterprise PeopleTools, potentially resulting in a takeover of the application.

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

An input validation issue was addressed with improved input validation. An attacker in a privileged network position may be able to leak sensitive user information.

A denial of service issue was addressed with improved validation. An attacker in a privileged position may be able to perform a denial of service attack.

The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to cross-site request forgery.

The issue allows for a XML External Entity Injection (XXE) attack when processing XML data, potentially enabling a remote attacker to expose sensitive information or consume memory resources.

The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session.

The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view, add, modify, or delete information in the back-end database.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Name of the Vulnerable Software and Affected Versions: OpenText Document Sciences xPression version 4.5SP1 Patch 13 Description: The issue is related to SQL Injection in xDashboard. Recommendations: For version 4.5SP1 Patch 13, at the moment, there is no information about a newer version that contains a fix for this issue.

The issue is related to an XML external entity (XXE) vulnerability in the web interface of OpenText Documentum Webtop. This vulnerability can be exploited by a remote attacker to read arbitrary files, cause a denial of service, or obtain user hashes on Windows systems. The exploitation involves crafted XML structures, such as a crafted DTD, in requests to specific API endpoints like `xda/com/documentum/ucf/server/transport/impl/GAIRConnector`, or through the import or check-in of crafted XML files in a MediaProfile file.

The issue is related to incorrect restriction of XML external entities (XXE) in the OpenText Documentum Administrator. This can be exploited by a remote attacker to read arbitrary files, cause a denial of service, or obtain user hashes on Windows systems. The exploitation involves crafted XML structures, such as a DTD, in requests to specific API endpoints like `xda/com/documentum/ucf/server/transport/impl/GAIRConnector`, or through the import or check-in of crafted XML files in a MediaProfile file.

A cross-site scripting issue allows authenticated remote users to execute arbitrary JavaScript code.