CVE-2009-1968
Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers to affect integrity via unknown vectors.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 40.1%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Unspecified vulnerability in the Secure Enterprise Search component in Oracle Database 10.1.8.3 allows remote attackers to affect integrity via unknown vectors. NOTE: the previous information was obtained from the July 2009 CPU. Oracle has not commented on claims from an established researcher that this is cross-site scripting (XSS) via the search_p_groups parameter in search/query/search.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 40.08% probability · 99th percentile
- CISA KEV
- Not listed
- Affected
- oracle/database server
- Source
- secalert_us@oracle.com
References
- http://archives.neohapsis.com/archives/bugtraq/2009-07/0110.html
- http://dsecrg.com/pages/vul/show.php?id=125
- http://osvdb.org/55892
- http://secunia.com/advisories/35776Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
- http://www.securityfocus.com/bid/35681
- http://www.securitytracker.com/id?1022560
- http://www.vupen.com/english/advisories/2009/1900Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51754
- http://archives.neohapsis.com/archives/bugtraq/2009-07/0110.html
- http://dsecrg.com/pages/vul/show.php?id=125
- http://osvdb.org/55892
- http://secunia.com/advisories/35776Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
- http://www.securityfocus.com/bid/35681
- http://www.securitytracker.com/id?1022560
- http://www.vupen.com/english/advisories/2009/1900Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51754
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.