CVE-2001-1464

Crystal Reports vulnerability: when displaying data for a password-protected database via HTML pages, it embeds the username and password in cleartext in the HTML content and in the URL, allowing remote attackers to obtain passwords. Affected: Crystal Reports HTML rendering for password-protected...

CVE-2005-0873

CVE-2005-0873 covers multiple XSS vulnerabilities in Oracle Reports Server 10g (9.0.4.3.3), specifically in test.jsp via the desname and repprod parameters. The NVD entry confirms remote, non-authenticated XSS with arbitrary script/HTML injection. Nessus plugin notes a remediation: disable access...

CVE-2005-0873

Multiple cross-site scripting XSS vulnerabilities in test.jsp in Oracle Reports Server 10g 9.0.4.3.3 allow remote attackers to inject arbitrary web script or HTML via the 1 desname or 2 repprod parameter...

oracleXSS10g.txt

Oracle Reports Server 10g 9.0.4.3.3 Vulnerable to Cross Site Scripting http://paolo/reports/examples/Tools/test.jsp?repprod&desname='alertdocument.cookie; http://paolo/reports/examples/Tools/test.jsp?repprod"alertdocument.cookie; Paolo sends GREETS to Oracle secalert Paolo...

Oracle Reports Server 10g - Multiple Cross-Site Scripting Vulnerabilities

Oracle Reports Server 10g - Multiple Cross-Site Scripting Vulnerabilities...

Oracle Reports Server 10g Vulnerable to XSS

Oracle Reports Server 10g 9.0.4.3.3 Vulnerable to Cross Site Scripting http://paolo/reports/examples/Tools/test.jsp?repprod&desname='scriptalertdocument.cookie;/script http://paolo/reports/examples/Tools/test.jsp?repprod"scriptalertdocument.cookie;/script Paolo sends GREETS to Oracle secalert Pao...

Oracle Reports Server test.jsp Multiple Parameter XSS

The remote host is running Oracle Report Server, a reporting application. The remote version of this software contains to a cross-site scripting vulnerability that may allow an attacker to use the remote host to perform a cross-site scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security...

Oracle Reports Server 10g - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/12892/info Multiple remote cross-site scripting vulnerabilities affect Oracle Reports Server. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content. An...

USN-88-1: reportbug information disclosure

Rolf Leggewie discovered two information disclosure bugs in reportbug. The per-user configuration file /.reportbugrc was created world-readable. If it contained email smarthost passwords, these were readable by any other user on the computer storing the home directory. reportbug usually includes...

CVE-2005-0625

reportbug 3.2 includes settings from .reportbugrc in bug reports, which exposes sensitive information such as smtpuser and smtppasswd...

Portcullis Security Advisory 05-009

Portcullis Security Advisory Vulnerable System: Webseries Payment Application Vulnerability Title: Execute Of Arbitrary Reports Vulnerability discovery and development: Portcullis Security Testing Services Affected systems: Bottomline Webseries Payment Application Details: Portcullis consultants...

Bugzilla < 2.16.7 / 2.18.0rc3 Multiple Information Disclosures

The remote Bugzilla bug tracking system, according to its version number, is vulnerable to various flaws that may let an attacker bypass authentication or get access to private bug reports. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

[SA12772] Crystal Reports JPEG Processing Buffer Overflow Vulnerability

TITLE: Crystal Reports JPEG Processing Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA12772 VERIFY ADVISORY: http://secunia.com/advisories/12772/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: Crystal Reports 9 http://secunia.com/product/2254/ Crystal Reports 1...

CVE-2004-0204

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers ...

RHEL 2.1 : webalizer (RHSA-2002:255)

Updated Webalizer packages are available for Red Hat Linux Advanced Server 2.1 which fix an obscure buffer overflow bug in the DNS resolver code. Updated 13 Jan 2003 Added fixed packages for the Itanium IA64 architecture. Updated 06 Feb 2003 Added fixed packages for Advanced Workstation 2.1...

CVE-2004-0204

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers ...

CVE-2004-0204

CVE-2004-0204 describes a directory traversal in Crystal Reports and Crystal Enterprise Web viewers redistributed with Microsoft Visual Studio .NET 2003, Outlook 2003 with Business Contact Manager, and Microsoft Business Solutions CRM 1.2. The vulnerability arises from improper validation of HTTP...

MS04-017: Crystal Reports Web Viewer Could Allow Information Disclosure and DoS (842689) (uncredentialed check)

The remote host is running a version of Crystal Report Web interface that is vulnerable to a remote directory traversal attack. An attacker exploiting this issue would be able to read or delete arbitrary files outside of the web root. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if...

Invision Power Board 1.3 - 'SSI.php' SQL Injection

source: https://www.securityfocus.com/bid/10511/info Invision Power Board is reported prone to an SQL injection vulnerability in its 'ssi.php' script. Due to improper filtering of user supplied data, 'ssi.php' is exploitable by attackers to pass SQL statements to the underlying database. The impa...

Vulnerability: Arbitrary File Access & DoS in Crystal Reports

Dear List, Impervatm's Applidcation Defense Center has recently discovered a vulnerability in Business Objects' Crystal Reports Web Delivery Modules. This vulnerability may lead to arbitrary file access and denial of service. Following are the advisory's details...