Cross-site scripting (XSS) vulnerability in boundary_rules.jsp in the Administration Front End for Oracle Enterprise (Ultra) Search, as used in Database Server 9.2.0.8, 10.1.0.5, and 10.2.0.2, and in Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2.0 allows remote attackers to inject arbitrary HTML or web script via the EXPTYPE parameter, aka SES01.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.us-cert.gov/cas/techalerts/TA07-108A.html | third-party-advisory x_refsource_CERT |
| http://www.red-database-security.com/advisory/oracle_css_ses.html | x_refsource_MISC |
| http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html | x_refsource_CONFIRM |
| http://www.securityfocus.com/archive/1/466156/100/0/threaded | mailing-list x_refsource_BUGTRAQ |
| http://www.securityfocus.com/bid/23532 | vdb-entry x_refsource_BID |
| http://www.securitytracker.com/id?1017927 | vdb-entry x_refsource_SECTRACK |
| http://www.securityfocus.com/archive/1/466329/100/200/threaded | vendor-advisory x_refsource_HP |
| http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html | x_refsource_MISC |
| http://www.securityfocus.com/archive/1/466329/100/200/threaded | vendor-advisory x_refsource_HP |
| http://www.vupen.com/english/advisories/2007/1426 | vdb-entry x_refsource_VUPEN |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://www.us-cert.gov/cas/techalerts/TA07-108A.html | third-party-advisory x_refsource_CERT x_transferred |
| http://www.red-database-security.com/advisory/oracle_css_ses.html | x_refsource_MISC x_transferred |
| http://www.oracle.com/technetwork/topics/security/cpuapr2007-090632.html | x_refsource_CONFIRM x_transferred |
| http://www.securityfocus.com/archive/1/466156/100/0/threaded | mailing-list x_refsource_BUGTRAQ x_transferred |
| http://www.securityfocus.com/bid/23532 | vdb-entry x_refsource_BID x_transferred |
| http://www.securitytracker.com/id?1017927 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://www.securityfocus.com/archive/1/466329/100/200/threaded | vendor-advisory x_refsource_HP x_transferred |
| http://www.red-database-security.com/advisory/oracle_cpu_apr_2007.html | x_refsource_MISC x_transferred |
| http://www.securityfocus.com/archive/1/466329/100/200/threaded | vendor-advisory x_refsource_HP x_transferred |
| http://www.vupen.com/english/advisories/2007/1426 | vdb-entry x_refsource_VUPEN x_transferred |