CVE-2018-2406

CVE-2018-2406 affects SAP Crystal Reports Server OEM Edition (CRSE) startup path: unquoted Windows search path leads to local directory/path traversal. Versions 4.0, 4.10, 4.20, 4.30 are affected; local privilege elevation is indicated in connected CNVD entry. The vulnerability’s CVSS notes local...

CVE-2018-2406: Unquoted Search Path or Element

Unquoted windows search path directory/path traversal vulnerability in Crystal Reports Server, OEM Edition CRSE, 4.0, 4.10, 4.20, 4.30, startup path...

PT-2018-15537

Name of the Vulnerable Software and Affected Versions Crystal Reports Server, OEM Edition CRSE versions 4.0 through 4.30 Description The issue concerns an unquoted windows search path, also known as a directory/path traversal vulnerability, in the startup path of the affected software...

Oracle Reports Server unauthorized report execution vulnerability-vulnerability warning-the black bar safety net

Affected system: Oracle Reports 9i Oracle Reports 6i 6.0.8.19 Oracle Reports 6i 6.0.8 Oracle Reports 6 Oracle Reports 10g 9.0.4.3.3 Oracle Reports 10g 9.0.4 Oracle Reports 10g 9.0.3 Oracle Reports 10g 9.0.2 Oracle Reports 10g 9.0.1 Oracle Reports 10g 9.0 Description:...

SurfControl SuperScout WebFilter for windows 2000 SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5859/info SurfControl SuperScout WebFilter Reports Server is prone to SQL injection attacks. This issue is due to insufficient input validation on the part of some of the reports files, which are implemented as .dlls. As ...

Oracle Reports Server 6.0.8/9.0.x Arbitrary File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14312/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary files. Reportedly, the server fails to restrict users from accessing parts of arbitrary files when handling specially crafted HTTP...

Oracle Reports Server 6.0.8/9.0.2 Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5262/info A problem with Reports Server could make it possible to gain sensitive information from the server. Under some circumstances, Reports Server may yield sensitive information to unauthenticated remote users. This...

Oracle Reports Server 10g Multiple Remote Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/12892/info Multiple remote cross-site scripting vulnerabilities affect Oracle Reports Server. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in...

SurfControl SuperScout WebFilter for windows 2000 File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5857/info SurfControl SuperScout WebFilter Reports Server is prone to a vulnerability which may allow remote attackers to disclose the contents of arbitrary files. The Reports Server does not sufficiently filter...

Oracle Reports Server 6.0.8/9.0.x XML File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14311/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary XML files. Reportedly, the server fails to restrict users from accessing parts of arbitrary XML files when handling specially...

Oracle Reports Server 6.0.8/9.0.x Unauthorized Report Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14316/info Oracle Reports Server is susceptible to an unauthorized report execution vulnerability. By placing a report file in a globally accessible location, users can trigger the execution of the report by issuing an HT...

Oracle Reports Server 10g 9.0.2 - Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/14313/info Multiple remote cross-site scripting vulnerabilities affect Oracle Reports Server. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may...

Crystal Reports Server InfoView logonAction Parameter XSS

The InfoView component included with the Crystal Reports Server install on the remote host contains a JSP script fails to sanitize user input to the 'logonAction' parameter of its 'logon.jsp' script before using it to generate dynamic HTML output. An attacker may be able to leverage this issue to...

CVE-2009-3344

Unspecified vulnerability in SAP Crystal Reports Server 2008 on Windows XP allows attackers to cause a denial of service infinite loop via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917, this disclosure has no actionable...

CVE-2009-3346

The CVE-2009-3346 entry concerns SAP Crystal Reports Server 2008 with an unspecified vulnerability that could allow remote code execution via unknown vectors, as demonstrated by VulnDisco Pack Professional versions 8.3–8.11. The description notes that, as of 2009-09-17, there is no actionable inf...

CVE-2009-3346

Unspecified vulnerability in SAP Crystal Reports Server 2008 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917, this disclosure has no actionable information. However,...

CVE-2009-3344: Undefined Security Weakness

Unspecified vulnerability in SAP Crystal Reports Server 2008 on Windows XP allows attackers to cause a denial of service infinite loop via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917, this disclosure has no actionable...

CVE-2009-3345: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in SAP Crystal Reports Server 2008 has unknown impact and attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917, this disclosure has no actionable information. However, because the VulnDisco Pack author...

CVE-2009-3346: Undefined Security Weakness

Unspecified vulnerability in SAP Crystal Reports Server 2008 allows remote attackers to execute arbitrary code via unknown vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.3 through 8.11. NOTE: as of 20090917, this disclosure has no actionable information. However,...

Update Protection against Oracle Reports Arbitrary File Reading Vulnerability

Oracle Reports is an enterprise reporting tool that extracts data from multiple sources and inserts it into a formatted report. Oracle Reports fails to validate URI parameters, possibly allowing a remote attacker to read arbitrary files on the Reports Server...