Unscored severity · published Jul 14, 2009
CVE-2009-1978
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via…
–
CVSS
64.7%
EPSS
No
On KEV
Description
Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows remote authenticated users to execute arbitrary code with SYSTEM privileges via vectors involving property_box.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)64.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Secure Backup · Oracle
10.2.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1978
osvdb.org
http://osvdb.org/55904
secunia.com
http://secunia.com/advisories/35776
www.oracle.com
http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
www.securityfocus.com
http://www.securityfocus.com/bid/35678
www.securitytracker.com
http://www.securitytracker.com/id?1022565
www.vupen.com
http://www.vupen.com/english/advisories/2009/1900
More from Secure Backup
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-26691
In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
7.5
CVE-2021-33193
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning
7.4
CVE-2021-3712
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length
7.4
CVE-2021-3450
CA certificate check bypass with X509_V_FLAG_X509_STRICT