7.5
CVE-2006-6697
- EPSS 10.32%
- Veröffentlicht 22.12.2006 02:28:00
- Zuletzt bearbeitet 16.06.2026 22:33:37
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginCRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the enc parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Application Server Portal Version9.0.2
Oracle ≫ Application Server Portal Version10g
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 10.32% | 0.951 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
http://marc.info/?l=full-disclosure&m=116664018702238&w=2
http://marc.info/?l=full-disclosure&m=116666155824901&w=2
http://secunia.com/advisories/23461
http://securityreason.com/securityalert/2057
http://www.securityfocus.com/archive/1/454945/100/0/threaded
http://www.securityfocus.com/archive/1/454965/100/0/threaded
http://www.securityfocus.com/archive/1/455106/100/0/threaded
http://www.securityfocus.com/bid/21686
http://www.vupen.com/english/advisories/2006/5124