CVE-2018-7659

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stored Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via a filename of an uploaded image file.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://vipinxsec.blogspot.com/2018/04/stored-xss-in-documentum-d2-steps-to.htmlExploit, Third Party Advisory
https://vipinxsec.blogspot.com/2018/04/stored-xss-in-documentum-d2-steps-to.htmlExploit, Third Party Advisory

Timeline

Published: Apr 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-76605.4In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Reflected Cross-Site Scripting Vulnerability could potentially be exploited by malic CVE-2018-76615.3Papenmeier WiFi Baby Monitor Free & Lite before 2.02.2 allows remote attackers to obtain audio data via certain requests to TCP ports 8258 a CVE-2018-76625.3Couch through 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpm CVE-2018-76636.1An issue was discovered in resources/views/layouts/app.blade.php in Voten.co before 2017-08-25. An unescaped template literal in the bio fie CVE-2018-76649.8An issue was discovered in ClipBucket before 4.0.0 Release 4902. Any OS commands can be injected via shell metacharacters in the file_name p CVE-2018-76659.8An issue was discovered in ClipBucket before 4.0.0 Release 4902. A malicious file can be uploaded via the name parameter to actions/beats_up CVE-2018-76669.8An issue was discovered in ClipBucket before 4.0.0 Release 4902. SQL injection vulnerabilities exist in the actions/vote_channel.php channel CVE-2018-76679.8Adminer through 4.3.1 has SSRF via the server parameter.CVE-2018-76687.5TestLink through 1.9.16 allows remote attackers to read arbitrary attachments via a modified ID field to /lib/attachments/attachmentdownload CVE-2018-76697.5An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a CVE-2018-76737.5The NetIQ Identity Manager communication channel, in versions prior to 4.7, is susceptible to a DoS attack.CVE-2018-76746.1The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection.