Oracle Reports vulnerabilities

6 CVEs affecting Oracle Reports, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2005-2983, published 2005-09-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2005-2371, published 2005-07-26. Medium severity, CVSS 5.0. EPSS: 22.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path…
CVE-2002-0947, published 2002-10-04. High severity, CVSS 7.5. EPSS: 9.5% chance of exploitation in the next 30 days. Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary code via a long…
CVE-2005-2378, published 2005-07-26. Medium severity, CVSS 5.0. EPSS: 9.1% chance of exploitation in the next 30 days. Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. …
CVE-2002-1089, published 2002-10-04. Medium severity, CVSS 5.0. EPSS: 5.4% chance of exploitation in the next 30 days. rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers to use the information in additional attacks.
CVE-2005-2379, published 2005-07-26. Medium severity, CVSS 4.3. EPSS: 3.6% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv, (2) test parameter to…
CVE-2005-2983, published 2005-09-20. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the…