Curated security research, vulnerabilities, advisories and tools for practitioners.

← back | CVE Intelligence

CVE-2014-6577

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2014-6577.

Coverage Span: 2015-01-21
Reports: 1 related reports

Associated Reports & Timeline

Advisory: XXE Injection in Oracle Database (CVE-2014-6577)

Oracle Database's XML parser (11.2.0.3-12.1.0.2) resolves external schemas, so XXE via extractvalue() lets a CREATE SESSION holder exfiltrate data over HTTP/FTP, port-scan, or trigger SSRF.