Various Cross-Site-Scripting Vulnerabilities in Oracle Reports

Name Various Cross-Site-Scripting Vulnerabilities in Oracle Reports Systems Affected Oracle Reports 9.0.2 Severity Low Risk Category Cross Site Scripting CSS/XSS Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Inital bug report...

Oracle Reports Server 6.0.8/9.0.x - Unauthorized Report Execution

source: https://www.securityfocus.com/bid/14316/info Oracle Reports Server is susceptible to an unauthorized report execution vulnerability. By placing a report file in a globally accessible location, users can trigger the execution of the report by issuing an HTTP GET request to the affected...

Oracle Reports Server 10g 9.0.2 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/14313/info Multiple remote cross-site scripting vulnerabilities affect Oracle Reports Server. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-base...

Oracle Reports Server 6.0.89.0.x - Unauthorized Report Execution

Oracle Reports Server 6.0.89.0.x - Unauthorized Report Execution source: https://www.securityfocus.com/bid/14316/info Oracle Reports Server is susceptible to an unauthorized report execution vulnerability. By placing a report file in a globally accessible location, users can trigger the execution...

Read parts of any XML-file via customize parameter in Oracle Reports

Name Read parts of any XML-file via customize parameter in Oracle Reports Systems Affected All version of Oracle Reports Severity Medium Risk Category Information disclosure Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Adviso...

Oracle Reports Server 6.0.89.0.x - Arbitrary File Disclosure

Oracle Reports Server 6.0.89.0.x - Arbitrary File Disclosure source: https://www.securityfocus.com/bid/14312/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary files. Reportedly, the server fails to restrict users from accessing parts of arbitrary files when...

Oracle Reports Server 10g 9.0.2 - Multiple Cross-Site Scripting Vulnerabilities

Oracle Reports Server 10g 9.0.2 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/14313/info Multiple remote cross-site scripting vulnerabilities affect Oracle Reports Server. An attacker may leverage these issues to have arbitrary script code executed in t...

Run any OS Command via unauthorized Oracle Reports

Name Run any OS Command via unauthorized Oracle Reports Systems Affected Oracle Reports 6.0, 6i, 9i, 10g Severity High Risk Category OS command execution Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Advisory AKSEC2003-014...

Oracle Reports Server 6.0.8/9.0.x - Arbitrary File Disclosure

source: https://www.securityfocus.com/bid/14312/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary files. Reportedly, the server fails to restrict users from accessing parts of arbitrary files when handling specially crafted HTTP GET requests. All versions of...

Oracle Reports Server 6.0.8/9.0.x - XML File Disclosure

source: https://www.securityfocus.com/bid/14311/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary XML files. Reportedly, the server fails to restrict users from accessing parts of arbitrary XML files when handling specially crafted HTTP GET requests. All version...

Overwrite any file via desname in Oracle Reports

Name Overwrite any file via desname in Oracle Reports Systems Affected Oracle Reports 6.0, 6i, 9i, 10g Severity High Risk Category File overwrite Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Advisory AKSEC2003-005 Inital bug...

Read parts of any file via desformat in Oracle Reports

Name Read parts of any file via desformat in Oracle Reports Systems Affected All version of Oracle Reports Severity Medium Risk Category Information disclosure Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Advisory AKSEC2003-0...

Oracle Reports Server 6.0.89.0.x - XML File Disclosure

Oracle Reports Server 6.0.89.0.x - XML File Disclosure source: https://www.securityfocus.com/bid/14311/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary XML files. Reportedly, the server fails to restrict users from accessing parts of arbitrary XML files when...

Dragonfly Commerce 1.0 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/14220/info Dragonfly Commerce is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a...

CVE-2005-2187

McAfee IntruShield Security Management System allows remote authenticated users to access the "Generate Reports" feature and modify alerts by setting the Access option to true, as demonstrated using the 1 fullAccess or 2 fullAccessRight parameter in reports-column-center.jsp, or 3 fullAccess...

CVE-2005-2187

McAfee IntruShield Security Management System allows remote authenticated users to access the "Generate Reports" feature and modify alerts by setting the Access option to true, as demonstrated using the 1 fullAccess or 2 fullAccessRight parameter in reports-column-center.jsp, or 3 fullAccess...

McAfee Intrushield IPS Abuse

/ $ An open security advisory 8 - McAfee Intrushield IPS Management Console Abuse 1: Bug Researcher: c0ntex - c0ntexbatgmail.com 2: Bug Released: July 06 2005 3: Bug Impact Rate: Medium / Hi 4: Bug Scope Rate: Local / Remote $ This advisory and/or proof of concept code must not be used for...

CVE-2004-1981

Technical details about CVE-2004-1981 are not publicly available in the provided documents. Monitor for updates.

CVE-2004-1981

The web interface for Crystal Reports allows remote attackers to cause a denial of service disk exhaustion by repeatedly requesting reports without retrieving the associated image files, which are not cleared from the image file folder...

CVE-2005-0873

Multiple cross-site scripting XSS vulnerabilities in test.jsp in Oracle Reports Server 10g 9.0.4.3.3 allow remote attackers to inject arbitrary web script or HTML via the 1 desname or 2 repprod parameter...