Description
The manual installation of Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 stores the SYS password in install.lst in plaintext, which allows local users to gain privileges.
Metrics
CVSS 2.0 4.6/10
AV:L/AC:L/Au:N/C:P/I:P/A:PAffected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0174.html
- http://marc.info/?l=bugtraq&m=112870441917345&w=2
- http://secunia.com/advisories/14935/Vendor Advisory
- http://www.red-database-security.com/advisory/oracle_htmldb_plaintext_password.htmlVendor Advisory
- http://www.securityfocus.com/bid/15033
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22542
- http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0174.html
- http://marc.info/?l=bugtraq&m=112870441917345&w=2
- http://secunia.com/advisories/14935/Vendor Advisory
- http://www.red-database-security.com/advisory/oracle_htmldb_plaintext_password.htmlVendor Advisory
- http://www.securityfocus.com/bid/15033
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22542
Timeline
- Published
- Oct 14, 2005
- Last modified
- Jun 16, 2026
- NVD status
- Modified