CVE-2005-2371

Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path sequences in the desname parameter. NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case it overlaps CVE-2006-0289.

• CWE-22

• http://marc.info/?l=bugtraq&m=112180096507467&w=2
• http://secunia.com/advisories/18493Vendor Advisory
• http://secunia.com/advisories/18608Vendor Advisory
• http://securitytracker.com/id?1014524
• http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html
• http://www.red-database-security.com/advisory/oracle_reports_overwrite_any_file.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/422257/30/7430/threaded
• http://www.securityfocus.com/bid/14309
• http://www.vupen.com/english/advisories/2006/0323Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24321
• http://marc.info/?l=bugtraq&m=112180096507467&w=2
• http://secunia.com/advisories/18493Vendor Advisory
• http://secunia.com/advisories/18608Vendor Advisory
• http://securitytracker.com/id?1014524
• http://www.oracle.com/technetwork/topics/security/cpujan2006-082403.html
• http://www.red-database-security.com/advisory/oracle_reports_overwrite_any_file.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/422257/30/7430/threaded
• http://www.securityfocus.com/bid/14309
• http://www.vupen.com/english/advisories/2006/0323Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24321

Published

Jul 26, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-2365Unknown vulnerability in the SMB dissector in Ethereal 0.9.0…
• CVE-2005-2366Unknown vulnerability in the BER dissector in Ethereal 0.10.…
• CVE-2005-2367Format string vulnerability in the proto_item_set_text funct…
• CVE-2005-2368vim 6.3 before 6.3.082, with modelines enabled, allows exter…
• CVE-2005-2369Multiple integer signedness errors in libgadu, as used in ek…
• CVE-2005-2370Multiple "memory alignment errors" in libgadu, as used in ek…
• CVE-2005-2372Oracle Forms 4.5 through 10g starts form executables from ar…
• CVE-2005-2373Buffer overflow in SlimFTPd 3.15 and 3.16 allows remote auth…
• CVE-2005-2374Belkin 54g wireless routers do not properly set an administr…
• CVE-2005-2375Format string vulnerability in Race Driver 1.20 and earlier …
• CVE-2005-2376Buffer overflow in Race Driver 1.20 and earlier allows remot…
• CVE-2005-2377nss_ldap 181 to versions before 213, as used in Mandrake Cor…