Oracle Reports SQL injection

It's possible to inject SQL to report if it uses lexical references without parameter validation...

DEBIAN-CVE-2005-2860

Cross-site scripting XSS vulnerability in Nikto 1.35 and earlier allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response header, which is directly injected into an HTML report...

[SA16282] Business Objects Enterprise / Crystal Reports Denial of Service

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

CVE-2005-2371

Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via 1 "..", 2 Windows drive letter C:, and 3 absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case ...

CVE-2005-2378

Oracle Reports (a component of Oracle Application Server) is affected by CVE-2005-2378 through a directory traversal in the rwservlet when the desformat parameter (or related URI parameters) is crafted with absolute/relative file paths. This allows reading arbitrary files on the Reports Server. T...

CVE-2005-2379

Multiple cross-site scripting XSS vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 debug parameter to showenv, 2 test parameter to parsequery, or 3 delimiter or 4 CELLWRAPPER parameter to rwservlet...

CVE-2005-2378

Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the 1 CUSTOMIZE or 2 desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU...

CVE-2005-2378

Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the 1 CUSTOMIZE or 2 desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU...

CVE-2005-2371

Directory traversal vulnerability in Oracle Reports Services (Oracle Application Server) allows remote attackers to overwrite arbitrary files via the desname parameter (e.g., using .., Windows drive letters, or absolute paths). Affected: Oracle Reports 6.0, 6i, 9i, 10g. Root cause: insufficient v...

CVE-2005-2371

Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via 1 "..", 2 Windows drive letter C:, and 3 absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case ...

CVE-2005-2379

Multiple cross-site scripting XSS vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 debug parameter to showenv, 2 test parameter to parsequery, or 3 delimiter or 4 CELLWRAPPER parameter to rwservlet...

CVE-2005-2379

Oracle Reports 9.0.2 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. The weaknesses are triggered via specific parameters: (1) debug in showenv, (2) test in parsequery, or (3) delimiter, and (4) CELLWRAPPER in ...

Oracle Reports Server 6.0.89.0.x - Arbitrary File Disclosure

Oracle Reports Server 6.0.89.0.x - Arbitrary File Disclosure source: https://www.securityfocus.com/bid/14312/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary files. Reportedly, the server fails to restrict users from accessing parts of arbitrary files when...

Overwrite any file via desname in Oracle Reports

Name Overwrite any file via desname in Oracle Reports Systems Affected Oracle Reports 6.0, 6i, 9i, 10g Severity High Risk Category File overwrite Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Advisory AKSEC2003-005 Inital bug...

Oracle Reports Server 6.0.89.0.x - Unauthorized Report Execution

Oracle Reports Server 6.0.89.0.x - Unauthorized Report Execution source: https://www.securityfocus.com/bid/14316/info Oracle Reports Server is susceptible to an unauthorized report execution vulnerability. By placing a report file in a globally accessible location, users can trigger the execution...

Read parts of any file via desformat in Oracle Reports

Name Read parts of any file via desformat in Oracle Reports Systems Affected All version of Oracle Reports Severity Medium Risk Category Information disclosure Vendor URL http://www.oracle.com Author Alexander Kornbrust ak at red-database-security.com Date 19 July 2005 V 1.00 Advisory AKSEC2003-0...

Oracle Reports Server 6.0.8/9.0.x - Arbitrary File Disclosure

source: https://www.securityfocus.com/bid/14312/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary files. Reportedly, the server fails to restrict users from accessing parts of arbitrary files when handling specially crafted HTTP GET requests. All versions of...

Oracle Reports Server 6.0.8/9.0.x - Unauthorized Report Execution

source: https://www.securityfocus.com/bid/14316/info Oracle Reports Server is susceptible to an unauthorized report execution vulnerability. By placing a report file in a globally accessible location, users can trigger the execution of the report by issuing an HTTP GET request to the affected...

Oracle Reports Server 6.0.8/9.0.x - XML File Disclosure

source: https://www.securityfocus.com/bid/14311/info Oracle Reports Server may allow remote attackers to disclose parts of arbitrary XML files. Reportedly, the server fails to restrict users from accessing parts of arbitrary XML files when handling specially crafted HTTP GET requests. All version...

Oracle Reports Server 10g 9.0.2 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/14313/info Multiple remote cross-site scripting vulnerabilities affect Oracle Reports Server. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-base...