Red-Database-Security GmbH is specialized in Oracle Security

Products
Repscan 2.5
Hedgehog Enterprise
Checkpwd (free)

Services
Oracle Audit / Hardening
Security Training
Consulting

Information
Oracle Security Blog
Published AlertsRSS Published Alerts
Upcoming AlertsRSS Published Alerts
Patch Information
Whitepaper
Presentations
Oracle Fact Sheets
Exploits
Tutorials
Videos
Scripts

News & Events
Events
News

Company
Contact
People
Partner
Impressum
Sitemap


Search



Search Red-Database-Security
Cross-Site-Scripting Vulnerability in Oracle WWV_FLOW_ITEM_HELP

Name Cross-Site-Scripting Vulnerability in Oracle APEX WWV_FLOW_ITEM_HELP
Systems Affected Oracle APEX/HTMLDB
Severity Medium Risk
Category Cross Site Scripting (XSS/CSS)
Vendor URL http://www.oracle.com/
Author Alexander Kornbrust (ak at red-database-security.com)
CVE CVE-2006-5351
Date 18 October 2006 (V 1.01)


Details
The package WWV_FLOW_ITEM_HELP contains a cross site scripting vulnerability.

Affected Products
Oracle APEX/HTMLDB < 2.2.1

Patch Information
This bug is fixed with the patch 2.2.1 of APEX which is not part of the Critical Patch Update October 2006. It's necessary to upgrade your APEX/HTMLDB installation to 2.2.1. Patches are currently not available for Oracle Application Express.



History
03-oct-2005 Oracle secalert was informed
04-oct-2005 Bug confirmed
17-oct-2006 Oracle published CPU October 2006
18-oct-2006 Red-Database-Security published this advisory
23-oct-2006 CVE added


2006 by Red-Database-Security GmbH - last update 23-oct-2006