CVE

Id
13584  
CVE No.
CVE-2005-2378  
Status
Candidate  
Description
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU.  
Phase
Assigned (20050726)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
98467 13584 CVE-2005-2378 BUGTRAQ:20050719 Oracle Security Advisory: Read parts of any XML-file via customize parameter in Oracle Reports  View
98468 13584 CVE-2005-2378 URL:http://marc.info/?l=bugtraq&m=112181242916757&w=2  View
98469 13584 CVE-2005-2378 BUGTRAQ:20050719 Oracle Security Advisory: Read parts of any file via desformat in Oracle Reports  View
98470 13584 CVE-2005-2378 URL:http://marc.info/?l=bugtraq&m=112181054226520&w=2  View
98471 13584 CVE-2005-2378 BUGTRAQ:20060117 Oracle Reports - Read parts of files via desname (fixed after 874 days)  View
98472 13584 CVE-2005-2378 URL:http://www.securityfocus.com/archive/1/archive/1/422256/30/7430/threaded  View
98473 13584 CVE-2005-2378 MISC:http://www.red-database-security.com/advisory/oracle_reports_read_any_file.html  View
98474 13584 CVE-2005-2378 MISC:http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.html  View
98475 13584 CVE-2005-2378 VUPEN:ADV-2006-0323  View
98476 13584 CVE-2005-2378 URL:http://www.vupen.com/english/advisories/2006/0323  View
98477 13584 CVE-2005-2378 SECTRACK:1014525  View
98478 13584 CVE-2005-2378 URL:http://securitytracker.com/id?1014525  View
98479 13584 CVE-2005-2378 SECTRACK:1014527  View
98480 13584 CVE-2005-2378 URL:http://securitytracker.com/id?1014527  View
98481 13584 CVE-2005-2378 SECUNIA:18493  View
98482 13584 CVE-2005-2378 URL:http://secunia.com/advisories/18493  View
98483 13584 CVE-2005-2378 SECUNIA:18608  View
98484 13584 CVE-2005-2378 URL:http://secunia.com/advisories/18608  View
98485 13584 CVE-2005-2378 XF:oracle-january2006-update(24321)  View

Related JVN