Unscored severity · published Jul 15, 2008
CVE-2008-2603
Unspecified vulnerability in the Resource Manager component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6, and Database Control in Enterprise Manager, has unknown impact and…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Unspecified vulnerability in the Resource Manager component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.6, and Database Control in Enterprise Manager, has unknown impact and remote authenticated attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims that this is a cross-site scripting (XSS) issue that allows remote attackers to inject arbitrary web script or HTML via the REFRESHCHOICE parameter in multiple web pages.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Enterprise Manager · Oracle
10.1.0.5; 10.2.0.4; 11.1.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2603
h20000.www2.hp.com
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143
Vendor Advisory
http://secunia.com/advisories/31087
Vendor Advisory
http://secunia.com/advisories/31113
www.oracle.com
http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/495093/100/0/threaded
www.securitytracker.com
http://www.securitytracker.com/id?1020496
More from Enterprise Manager
9.8
CVE-2004-1363
Buffer overflow in extproc in Oracle 10g allows remote attackers to execute arbitrary code via environment variables in the library name, which are expanded after the length check…
8.3
CVE-2024-20916
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management)
7.5
CVE-2019-2895
Vulnerability in the Enterprise Manager for Exadata product of Oracle Enterprise Manager (component: Exadata Plug-In Deploy and Ins)
7.5
CVE-2018-11040
Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON…
7.3
CVE-2021-2008
Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Control Plugin)