Name Cross-Site-Scripting Vulnerability in Oracle Secure Enterprise Search Systems Affected Oracle Secure Enterprise Search 10.1.6- SES Severity Medium Risk Category Cross Site Scripting (XSS/CSS) Vendor URL http://www.oracle.com/ Author Alexander Kornbrust (ak at red-database-security.com) Date 17 April 2007 (V 1.00) Details ####### Oracle Secure Enterprise Search 10g, a standalone product from Oracle, enables a secure, high quality, easy-to-use search across all enterprise information assets. The parameter EXPTYPE in boundary_rules.jsp contains a cross site scripting vulnerability. This advisory is available at Exploit ####### Affected Products ################# Oracle Enterprise Search Patch Information ################# Please upgrade to the latest version of SES or apply CPU April 2007. History ####### 05-Apr-2005 Oracle secalert was informed 06-Apr-2005 Bug confirmed 17-apr-2007 Oracle published CPU April 2007 17-apr-2007 Red-Database-Security published this advisory Additional Information ###################### An analysis of the Oracle CPU April 2007 is available here This document will be updated during the next few days and weeks with the latest information. (c) 2007 by Red-Database-Security GmbH -- http://www.red-database-security.com