CVE-2004-1981: Undefined Security Weakness

The web interface for Crystal Reports allows remote attackers to cause a denial of service disk exhaustion by repeatedly requesting reports without retrieving the associated image files, which are not cleared from the image file folder...

CVE-2005-0873

Multiple cross-site scripting XSS vulnerabilities in test.jsp in Oracle Reports Server 10g 9.0.4.3.3 allow remote attackers to inject arbitrary web script or HTML via the 1 desname or 2 repprod parameter...

CVE-2001-1464

Crystal Reports vulnerability: when displaying data for a password-protected database via HTML pages, it embeds the username and password in cleartext in the HTML content and in the URL, allowing remote attackers to obtain passwords. Affected: Crystal Reports HTML rendering for password-protected...

CVE-2001-1464: Undefined Security Weakness

Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords...

CVE-2005-0873

Multiple cross-site scripting XSS vulnerabilities in test.jsp in Oracle Reports Server 10g 9.0.4.3.3 allow remote attackers to inject arbitrary web script or HTML via the 1 desname or 2 repprod parameter...

CVE-2005-0873

CVE-2005-0873 covers multiple XSS vulnerabilities in Oracle Reports Server 10g (9.0.4.3.3), specifically in test.jsp via the desname and repprod parameters. The NVD entry confirms remote, non-authenticated XSS with arbitrary script/HTML injection. Nessus plugin notes a remediation: disable access...

CVE-2005-0873: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in test.jsp in Oracle Reports Server 10g 9.0.4.3.3 allow remote attackers to inject arbitrary web script or HTML via the 1 desname or 2 repprod parameter...

oracleXSS10g.txt

Oracle Reports Server 10g 9.0.4.3.3 Vulnerable to Cross Site Scripting http://paolo/reports/examples/Tools/test.jsp?repprod&desname='alertdocument.cookie; http://paolo/reports/examples/Tools/test.jsp?repprod"alertdocument.cookie; Paolo sends GREETS to Oracle secalert Paolo...

Oracle Reports Server 10g - Multiple Cross-Site Scripting Vulnerabilities

Oracle Reports Server 10g - Multiple Cross-Site Scripting Vulnerabilities...

Oracle Reports Server 10g Vulnerable to XSS

Oracle Reports Server 10g 9.0.4.3.3 Vulnerable to Cross Site Scripting http://paolo/reports/examples/Tools/test.jsp?repprod&desname='scriptalertdocument.cookie;/script http://paolo/reports/examples/Tools/test.jsp?repprod"scriptalertdocument.cookie;/script Paolo sends GREETS to Oracle secalert Pao...

Oracle Reports Server test.jsp Multiple Parameter XSS

The remote host is running Oracle Report Server, a reporting application. The remote version of this software contains to a cross-site scripting vulnerability that may allow an attacker to use the remote host to perform a cross-site scripting attack. %NASLMINLEVEL 70300 C Tenable Network Security...

Oracle Reports Server 10g - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/12892/info Multiple remote cross-site scripting vulnerabilities affect Oracle Reports Server. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content. An...

USN-88-1: reportbug information disclosure

Rolf Leggewie discovered two information disclosure bugs in reportbug. The per-user configuration file /.reportbugrc was created world-readable. If it contained email smarthost passwords, these were readable by any other user on the computer storing the home directory. reportbug usually includes...

CVE-2005-0625

reportbug 3.2 includes settings from .reportbugrc in bug reports, which exposes sensitive information such as smtpuser and smtppasswd...

Portcullis Security Advisory 05-009

Portcullis Security Advisory Vulnerable System: Webseries Payment Application Vulnerability Title: Execute Of Arbitrary Reports Vulnerability discovery and development: Portcullis Security Testing Services Affected systems: Bottomline Webseries Payment Application Details: Portcullis consultants...

Bugzilla < 2.16.7 / 2.18.0rc3 Multiple Information Disclosures

The remote Bugzilla bug tracking system, according to its version number, is vulnerable to various flaws that may let an attacker bypass authentication or get access to private bug reports. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc';...

[SA12772] Crystal Reports JPEG Processing Buffer Overflow Vulnerability

TITLE: Crystal Reports JPEG Processing Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA12772 VERIFY ADVISORY: http://secunia.com/advisories/12772/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: Crystal Reports 9 http://secunia.com/product/2254/ Crystal Reports 1...

CVE-2004-0204

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers ...

RHEL 2.1 : webalizer (RHSA-2002:255)

Updated Webalizer packages are available for Red Hat Linux Advanced Server 2.1 which fix an obscure buffer overflow bug in the DNS resolver code. Updated 13 Jan 2003 Added fixed packages for the Itanium IA64 architecture. Updated 06 Feb 2003 Added fixed packages for Advanced Workstation 2.1...

CVE-2004-0204

Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers ...