CVE-2010-3595

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 12%

from disclosure to weapon7 days

Published on NVDJan 19

1st PoC+7d

exploitation probability

12%top 4% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality via unknown vectors related to Import Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can read arbitrary files via a full pathname in the first argument to the ImportBodyText method in the EasyMail ActiveX control (emsmtp.dll).

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/16056unverified exploitdbwww.exploit-db.com/exploits/16056unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://dsecrg.com/pages/vul/show.php?id=307 http://secunia.com/advisories/42976 https://exchange.xforce.ibmcloud.com/vulnerabilities/64770 http://www.exploit-db.com/exploits/16056 http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html http://www.securityfocus.com/archive/1/515957/100/0/threaded http://www.securityfocus.com/bid/45849 http://www.securitytracker.com/id?1024981 http://www.vupen.com/english/advisories/2011/0143