Unscored severity · published Jul 26, 2005
CVE-2005-2378
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat…
–
CVSS
9.1%
EPSS
No
On KEV
Description
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.1% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Reports · Oracle
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-2378
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-2378
marc.info
http://marc.info/?l=bugtraq&m=112181054226520&w=2
marc.info
http://marc.info/?l=bugtraq&m=112181242916757&w=2
Vendor Advisory
http://secunia.com/advisories/18493
Vendor Advisory
http://secunia.com/advisories/18608
securitytracker.com
http://securitytracker.com/id?1014525
securitytracker.com
http://securitytracker.com/id?1014527
More from Reports
–
CVE-2005-2983
SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that…
–
CVE-2005-2371
Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3)…
–
CVE-2005-2379
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv,…
–
CVE-2002-0947
Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary…
–
CVE-2002-1089
rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers to use the information in…