CVE-2005-2983

SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramform parameter is set to yes...

CVE-2005-2983

SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramform parameter is set to yes...

CVE-2005-2983

CVE-2005-2983 describes an SQL injection vulnerability in Oracle Reports that use Lexical References. The vulnerability arises when the paramform parameter is set to yes, allowing remote attackers to manipulate values in the parameter form and execute arbitrary SQL commands. The issue is document...

CVE-2005-2983: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramform parameter is set to yes...

Oracle Reports: Generic SQL Injection Vulnerability via lexical references

Hello Today I published a new advisory concerning a generic SQL Injection vulnerability in Oracle Reports. Details Oracle Reports provides a feature called lexical references. A lexical reference is a placeholder for text that you embed in a SELECT statement. It is possible to replace the clauses...

Oracle Reports SQL injection

It's possible to inject SQL to report if it uses lexical references without parameter validation...

DEBIAN-CVE-2005-2860

Cross-site scripting XSS vulnerability in Nikto 1.35 and earlier allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response header, which is directly injected into an HTML report...

[SA16282] Business Objects Enterprise / Crystal Reports Denial of Service

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

CVE-2005-2371

Directory traversal vulnerability in Oracle Reports Services (Oracle Application Server) allows remote attackers to overwrite arbitrary files via the desname parameter (e.g., using .., Windows drive letters, or absolute paths). Affected: Oracle Reports 6.0, 6i, 9i, 10g. Root cause: insufficient v...

CVE-2005-2379

Oracle Reports 9.0.2 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. The weaknesses are triggered via specific parameters: (1) debug in showenv, (2) test in parsequery, or (3) delimiter, and (4) CELLWRAPPER in ...

CVE-2005-2378

Oracle Reports (a component of Oracle Application Server) is affected by CVE-2005-2378 through a directory traversal in the rwservlet when the desformat parameter (or related URI parameters) is crafted with absolute/relative file paths. This allows reading arbitrary files on the Reports Server. T...

CVE-2005-2378

Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the 1 CUSTOMIZE or 2 desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU...

CVE-2005-2371

Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via 1 "..", 2 Windows drive letter C:, and 3 absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case ...

CVE-2005-2379

Multiple cross-site scripting XSS vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 debug parameter to showenv, 2 test parameter to parsequery, or 3 delimiter or 4 CELLWRAPPER parameter to rwservlet...

CVE-2005-2378

Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the 1 CUSTOMIZE or 2 desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU...

CVE-2005-2379

Multiple cross-site scripting XSS vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 debug parameter to showenv, 2 test parameter to parsequery, or 3 delimiter or 4 CELLWRAPPER parameter to rwservlet...

CVE-2005-2371

Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via 1 "..", 2 Windows drive letter C:, and 3 absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case ...

CVE-2005-2379: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 debug parameter to showenv, 2 test parameter to parsequery, or 3 delimiter or 4 CELLWRAPPER parameter to rwservlet...

CVE-2005-2371: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via 1 "..", 2 Windows drive letter C:, and 3 absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case ...

CVE-2005-2378: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the 1 CUSTOMIZE or 2 desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU...