Oracle RDC Onsite XSS Vulnerability

October 18, 2011;

Michael Schmidt from Compass Security identified a vulnerability in an Oracle product. It is possible to insert JavaScript code into the search form of the RDC Onsite Help form. This JavaScript code is returned to the user without critical characters being replaced to their corresponding HTML entities. Oracle confirmed this vulnerability and released a patch. Oracle Tracking ID: 18244549 Advisory Date: 2011-10-18

Links:	Oracle Credit Statement Compass Advisory