Unscored severity · published Dec 6, 2007
CVE-2007-6260
The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the Listener
–
CVSS
1.4%
EPSS
No
On KEV
Description
The installation process for Oracle 10g and llg uses accounts with default passwords, which allows remote attackers to obtain login access by connecting to the Listener. NOTE: at the end of the installation, if performed using the Database Configuration Assistant (DBCA), most accounts are disabled or their passwords are changed.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Database Server · Oracle
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-6260
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-6260
osvdb.org
http://osvdb.org/43673
securityreason.com
http://securityreason.com/securityalert/3419
www.davidlitchfield.com
http://www.davidlitchfield.com/blog/archives/00000030.htm
www.oracle.com
http://www.oracle.com/technology/deploy/security/pdf/twp_security_checklist_db_database_20071108.pdf
www.securityfocus.com
http://www.securityfocus.com/archive/1/483652/100/200/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/26425
More from Database Server
10.0
CVE-2020-1953
Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements
9.9
CVE-2026-61211
Vulnerability in the RDBMS component of Oracle Database Server
9.9
CVE-2018-3110
A vulnerability was discovered in the Java VM component of Oracle Database Server
9.8
CVE-2019-16942
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10
9.8
CVE-2018-14719
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from…