CVE:CVE-2005-3204
CNNVD:CNNVD-200510-090
Oracle XML DB 是 Oracle 数据库的一个特性。它提供一种自带的高性能 XML 存储和检索技术。该技术将 W3C XML 数据模型完全集成到 Oracle 数据库中，并提供浏览和查询 XML 的新的标准访问方法。
Oracle XML DB 9iR2存在跨站脚本攻击(XSS)漏洞。远程攻击者可以借助HTTP请求中的查询字符串注入任意web脚本或HTML。
solution:Upgrade oracle application_server to a higher version than 9.0.2,9.0.2.0.0,9.0.2.0.1,9.0.2.1,9.0.2.2,9.0.2.3,9.0.3,9.0.3.1,9.2.0.6,and avoid the version 9.0.2,9.0.2.0.0,9.0.2.0.1,9.0.2.1,9.0.2.2,9.0.2.3,9.0.3,9.0.3.1,9.2.0.6; Upgrade oracle oracle9i to a higher version than client_9.2.0.1,client_9.2.0.2,developer_9.0.4,enterprise_9.0.1,enterprise_9.0.1.4,enterprise_9.0.1.5,enterprise_9.0.1.5_fips,enterprise_9.0.4,enterprise_9.2.0,enterprise_9.2.0.1,enterprise_9.2.0.2,enterprise_9.2.0.3,enterprise_9.2.0.4,enterprise_9.2.0.5,enterprise_9.2.0.6,personal_9.0.1,personal_9.0.1.4,personal_9.0.1.5,personal_9.0.1.5_fips,personal_9.0.4,personal_9.2,personal_9.2.0.1,personal_9.2.0.2,personal_9.2.0.3,personal_9.2.0.4,personal_9.2.0.5,personal_9.2.0.6,standard_9.0,standard_9.0.1,standard_9.0.1.2,standard_9.0.1.3,standard_9.0.1.4,standard_9.0.1.5,standard_9.0.1.5_fips,standard_9.0.2,standard_9.0.4,standard_9.2,standard_9.2.0.1,standard_9.2.0.2,standard_9.2.0.3,standard_9.2.0.4,standard_9.2.0.5,standard_9.2.0.6,standard_9.2.3,and avoid the version client_9.2.0.1,client_9.2.0.2,developer_9.0.4,enterprise_9.0.1,enterprise_9.0.1.4,enterprise_9.0.1.5,enterprise_9.0.1.5_fips,enterprise_9.0.4,enterprise_9.2.0,enterprise_9.2.0.1,enterprise_9.2.0.2,enterprise_9.2.0.3,enterprise_9.2.0.4,enterprise_9.2.0.5,enterprise_9.2.0.6,personal_9.0.1,personal_9.0.1.4,personal_9.0.1.5,personal_9.0.1.5_fips,personal_9.0.4,personal_9.2,personal_9.2.0.1,personal_9.2.0.2,personal_9.2.0.3,personal_9.2.0.4,personal_9.2.0.5,personal_9.2.0.6,standard_9.0,standard_9.0.1,standard_9.0.1.2,standard_9.0.1.3,standard_9.0.1.4,standard_9.0.1.5,standard_9.0.1.5_fips,standard_9.0.2,standard_9.0.4,standard_9.2,standard_9.2.0.1,standard_9.2.0.2,standard_9.2.0.3,standard_9.2.0.4,standard_9.2.0.5,standard_9.2.0.6,standard_9.2.3