Update Protection against Oracle Reports Arbitrary File Reading Vulnerability

Oracle Reports is an enterprise reporting tool that extracts data from multiple sources and inserts it into a formatted report. Oracle Reports fails to validate URI parameters, possibly allowing a remote attacker to read arbitrary files on the Reports Server...

Update Protection against Oracle Reports Server Multiple Vulnerabilities

Oracle Reports is a reporting tool that generates data from multiple sources and converts the information into a formatted report. Several vulnerabilities were reported in Oracle Reports server which can be exploited to overwrite arbitrary files, conduct cross-site scripting attacks, gain local...

Oracle Reports arbitrary file writing vulnerability

Overview Oracle Reports fails to validate URI parameters, possibly allowing a remote attacker to overwrite arbitrary files on the Reports Server. Description Oracle Reports is an enterprise reporting tool that extracts data from multiple sources and inserts it into a formatted report. It is a...

Oracle Reports arbitrary file reading vulnerability

Overview Oracle Reports fails to validate URI parameters, possibly allowing a remote attacker to read arbitrary files on the Reports Server. Description Oracle Reports is an enterprise reporting tool that extracts data from multiple sources and inserts it into a formatted report. It is a componen...

Directory traversal

Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26PS17 and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln 1 REP05 and 2 REP06 in the Oracle Reports Developer component. NOTE: Oracle has not disputed reliab...

CVE-2006-0275

Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that...

CVE-2006-0275

CVE-2006-0275 affects Oracle Application Server 9.0.4.2, specifically the Oracle Reports Developer component. The connected documents identify the issue as a directory traversal vulnerability that can read portions of arbitrary XML files via the customize parameter (Oracle Vuln REP04). The NVD me...

[Full-disclosure] Oracle Reports - Overwrite any application server file via desname (fixed after 889 days)

Hello FD-Reader It took only 889 days to fix this problem. Summary and additional information concerning the Oracle January 2006 CPU is available here: http://www.red-database-security.com/advisory/oraclecpujan2006.html http://www.red-database-security.com/advisory/oraclereportsoverwritea...

[Full-disclosure] Oracle Reports - Read parts of files via desname (fixed after 874 days)

Hello FD-Reader It took only 874 days to fix this problem. Summary and additional information concerning the Oracle January 2006 CPU is available here: http://www.red-database-security.com/advisory/oraclecpujan2006.html http://www.red-database-security.com/advisory/oraclereportsreadanyfi le.html...

CVE-2005-2983

SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramform parameter is set to yes...

CVE-2005-2983

SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramform parameter is set to yes...

CVE-2005-2371

Directory traversal vulnerability in Oracle Reports Services (Oracle Application Server) allows remote attackers to overwrite arbitrary files via the desname parameter (e.g., using .., Windows drive letters, or absolute paths). Affected: Oracle Reports 6.0, 6i, 9i, 10g. Root cause: insufficient v...

CVE-2005-2378

Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the 1 CUSTOMIZE or 2 desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU...

CVE-2005-2378

Oracle Reports (a component of Oracle Application Server) is affected by CVE-2005-2378 through a directory traversal in the rwservlet when the desformat parameter (or related URI parameters) is crafted with absolute/relative file paths. This allows reading arbitrary files on the Reports Server. T...

CVE-2005-2379

Multiple cross-site scripting XSS vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 debug parameter to showenv, 2 test parameter to parsequery, or 3 delimiter or 4 CELLWRAPPER parameter to rwservlet...

CVE-2005-2371

Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via 1 "..", 2 Windows drive letter C:, and 3 absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case ...

Various Cross-Site-Scripting Vulnerabilities in Oracle Reports

Name Various Cross-Site-Scripting Vulnerabilities in Oracle Reports Systems Affected Oracle Reports 9.0.2 Severity Low Risk Category Cross Site Scripting CSS/XSS Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Inital bug report...

Oracle Reports Server 6.0.8/9.0.x - Unauthorized Report Execution

source: https://www.securityfocus.com/bid/14316/info Oracle Reports Server is susceptible to an unauthorized report execution vulnerability. By placing a report file in a globally accessible location, users can trigger the execution of the report by issuing an HTTP GET request to the affected...

Read parts of any XML-file via customize parameter in Oracle Reports

Name Read parts of any XML-file via customize parameter in Oracle Reports Systems Affected All version of Oracle Reports Severity Medium Risk Category Information disclosure Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Adviso...

Oracle Reports Server 6.0.89.0.x - Arbitrary File Disclosure

Oracle Reports Server 6.0.89.0.x - Arbitrary File Disclosure source: https://www.securityfocus.com/bid/14312/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary files. Reportedly, the server fails to restrict users from accessing parts of arbitrary files when...