| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 29 Jan 2009 07:12:07 -0700 From: DoZ@...kersCenter.com To: bugtraq@...urityfocus.com Subject: Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet) Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet) About: Oracle Forms is a tool (somewhat like Visual Basic in appearance, but the code inside is PL/SQL) which allows a developer to quickly create user-interface applications which access an Oracle database in a very efficient and tightly-coupled way. It was originally developed to run server-side in character mode on any Unix box, before Windows existed. It was then ported to Windows to function in a client-server environment. This could be exploited to conduct cross site scripting attacks. Attackers can run arbitrary code that can be executed by the user's browser in the security context of an affected site. Attackers can exploit these issues via a web client. Hackers Center Security Group (http://www.hackerscenter.com) Credit: Oleg P. Class: Cross Site Scripting Remote: Yes Risk: Medium Product: Oracle Forms 6i Servlets Version: Tested 6i Servlets/ Other version may be affrected too. (E-Business Suite 11i) Vendor: http://www.oracle.com iFcgi60.exe / f60servlet Cross site scripting ifcgi60.exe?form=XSS iFcgi60.exe Google: http://www.google.com/search?hl=en&q=ext%3Aexe+inurl%3A(ifcgi60)&btnG=Search f60servlet?&form=XSS f60servlet Google: http://www.google.com/search?hl=en&q=inurl%3A(f60servlet)&btnG=Search Open Admin Access: f60servlet/admin PATCHES AND UPDATES: http://www.oracle.com/technology/deploy/security/alerts.htm
Powered by blists - more mailing lists