Cross Site Scripting in BEA Admin Console

From: Alexander Kornbrust (ak_at_red-database-security.com)
Date: 04/28/05

  • Next message: Scott Grayban: "Re: Security contact at sourceforge?" 
    Date: 28 Apr 2005 16:51:48 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Red-Database-Security GmbH Research Advisory

    Name Cross Site Scripting in BEA Admin Console
    Systems Affected BEA Admin Console 8.1
    Severity Low Risk
    Category Cross Site Scripting (CSS/XSS)
    Vendor URL http://www.bea.com
    Author Alexander Kornbrust (ak at red-database-security.com)
    Date 28 Apr 2005 (V 1.00)
    Advisory number AKSEC2004-042

    Description
    ###########
    Cross Site Scripting in BEA Admin Console.

    More details available:
    #######################

    http://www.red-database-security.com/advisory/bea_css_in_admin_console.html

    Patch Information
    #################
    Apply the latest patchset from BEA.

    History:
    ########
    13 April 2004 BEA secalert was informed
    13 April 2004 Bug confirmed
    25 April 2005 Advisory released

    About Red-Database-Security GmbH
    #################################
    Red-Database-Security GmbH is a specialist in Oracle Security.

    http://www.red-database-security.com

  • Next message: Scott Grayban: "Re: Security contact at sourceforge?"