CVE-2006-0275

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-01-18 · updated 2026-06-16

Description

Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that allows reading of portions of arbitrary XML files via the customize parameter.

Affected products

Oracle Application Server: 9.0.4.2

References

http://secunia.com/advisories/18493
http://secunia.com/advisories/18608
http://securitytracker.com/id?1015499
http://www.kb.cert.org/vuls/id/545804
http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html
http://www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.html
http://www.securityfocus.com/archive/1/422261/30/7430/threaded
http://www.securityfocus.com/bid/16287
http://www.vupen.com/english/advisories/2006/0243
http://www.vupen.com/english/advisories/2006/0323
https://exchange.xforce.ibmcloud.com/vulnerabilities/24321
http://secunia.com/advisories/18493

Get alerted when CVE-2006-0275 or the next vulnerability affects your stack