Reports

This hub aggregates every CVE we track for Reports, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 10 most recently published vulnerabilities affecting Reports.

• CVE-2024-29885Reports are still accessible even when `canView()` returns false in silverstripe/reports4.3Jul 17, 2024
• CVE-2022-39181GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS)6.1Nov 17, 2022
• CVE-2021-42777Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application ser...9.8Oct 29, 2022
• CVE-2020-15865A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0 allows an attacker to encode C# scripts as base-64 in the report XML file so that they will be compiled an...9.8Aug 18, 2020
• CVE-2005-2983SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the values in the parameter form that appears when the paramf...7.5Sep 19, 2005
• CVE-2005-2371Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path sequ...5.0Jul 26, 2005
• CVE-2005-2378Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet. ...5.0Jul 26, 2005
• CVE-2005-2379Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv, (2) test parameter ...4.3Jul 26, 2005
• CVE-2002-0947Buffer overflow in rwcgi60 CGI program for Oracle Reports Server 6.0.8.18.0 and earlier, as used in Oracle9iAS and other products, allows remote attackers to execute arbitrary code via a long datab...7.5Apr 2, 2003
• CVE-2002-1089rwcgi60 CGI program in Oracle Reports Server, by design, provides sensitive information such as the full pathname, which could enable remote attackers to use the information in additional attacks.5.0Aug 31, 2002