92
CVEs
5
Critical
55
High
0
KEV
25
PoC
59
Unpatched C/H
2.2%
Patch Rate
1.4%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
55
MEDIUM
28
LOW
4
Monthly CVE Trend
Affected Products (29)
Brava Desktop
35
Documentum Content Server
8
Vertica
6
Documentum Webtop
6
Document Sciences Xpression
6
Exceed Ondemand
4
Documentum Administrator
4
Web Site Management Server
3
Documentum D2
3
Arcsight Intelligence
3
Brava
2
Open Redirect
2
Xm Fax
2
Filr
2
Access Manager
2
Operations Agent
1
Directory Services
1
Content Server
1
Opentext Ixos Ecm For Sap Netweaver
1
Tomcat
1
PostgreSQL
1
Zenworks Service Desk
1
Tempo Box
1
Alm Octane
1
Identity Manager
1
Idm Driver And Extensions
1
Secure Mft 2014
1
Java
1
Secure Mft 2013
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2017-5586 | OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the BeanShell (bsh) and Apache Commons. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 35.3%. | CRITICAL | 9.8 | 35.3% | 104 |
PoC
No patch
|
| CVE-2017-15012 | OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the input of the PUT_FILE RPC-command, which allows any authenticated user to hijack. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 4.1% | 68 |
PoC
No patch
|
| CVE-2017-15013 | OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 3.4% | 67 |
PoC
No patch
|
| CVE-2017-15276 | OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 2.6% | 67 |
PoC
No patch
|
| CVE-2017-7221 | OpenText Documentum Content Server has an inadequate protection mechanism against SQL injection, which allows remote authenticated users to execute arbitrary code with super-user privileges by. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 1.6% | 66 |
PoC
No patch
|
| CVE-2017-5585 | OpenText Documentum Content Server (formerly EMC Documentum Content Server) 7.3, when PostgreSQL Database is used and return_top_results_row_based config option is false, does not properly restrict. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.7% | 65 |
PoC
No patch
|
| CVE-2017-7220 | OpenText Documentum Content Server allows superuser access via sys_obj_save or save of a crafted object, followed by an unauthorized "UPDATE dm_dbo.dm_user_s SET user_privileges=16" command, aka an. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.7% | 65 |
PoC
No patch
|
| CVE-2017-14527 | Multiple XML external entity (XXE) vulnerabilities in the OpenText Documentum Webtop 6.8.0160.0073 allow remote authenticated users to list the contents of arbitrary directories, read arbitrary. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.6% | 65 |
PoC
No patch
|
| CVE-2017-14757 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection:. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2017-14758 | OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection:. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2023-31871 | OpenText Documentum Content Server before 23.2 has a flaw that allows for privilege escalation from a non-privileged Documentum user to root. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.8 | 0.3% | 59 |
PoC
No patch
|
| CVE-2013-3243 | Unspecified vulnerability in OpenText/IXOS ECM for SAP NetWeaver allows remote attackers to execute arbitrary ABAP code via unknown vectors. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available. | MEDIUM | 6.8 | 0.4% | 54 |
PoC
No patch
|
| CVE-2025-13671 | Web Site Management Server versions up to 16.7.0 is affected by cross-site request forgery (csrf) (CVSS 6.5). | MEDIUM | 6.5 | 0.0% | 53 |
PoC
No patch
|
| CVE-2016-2002 | The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x before 7.0.2.12, 7.1.x before 7.1.2-12, and 7.2.x before 7.2.2-1 allows remote attackers to execute arbitrary. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution. | CRITICAL | 9.8 | 2.9% | 52 |
|
| CVE-2017-14524 | Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a (1) URL in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.1 | 1.2% | 52 |
PoC
No patch
|