CVE-2010-3600

60Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 77%

de la publicación al arma666 días

Publicada en NVD19 ene

1ª PoC+666d

metasploit18 ene

probabilidad de explotación

77%top 1% de las CVE

explotación observada

noninguna fuente lo reporta

2 exploit(s) público(s)

Unspecified vulnerability in the Client System Analyzer component in Oracle Database Server 11.1.0.7 and 11.2.0.1 and Enterprise Manager Grid Control 10.2.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that this issue involves an exposed JSP script that accepts XML uploads in conjunction with NULL bytes in an unspecified parameter that allow execution of arbitrary code.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2

githubgithub.com/LAITRUNGMINHDUC/CVE-2010-3600-PythonHackOracle11gR2★ 2 exploitdbwww.exploit-db.com/exploits/22714no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://secunia.com/advisories/42895 http://secunia.com/advisories/42921 https://exchange.xforce.ibmcloud.com/vulnerabilities/64755 http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html http://www.securityfocus.com/bid/45883 http://www.securitytracker.com/id?1024972 http://www.vupen.com/english/advisories/2011/0139 http://www.vupen.com/english/advisories/2011/0140 http://www.zerodayinitiative.com/advisories/ZDI-11-018/